CVE-2025-49034: WordPress Funnel Builder by FunnelKit plugin <= 3.10.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.
Other sources
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.10.2.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49034?
CVE-2025-49034 is classified as a high severity vulnerability due to its ability to allow SQL Injection attacks.
How do I fix CVE-2025-49034?
To fix CVE-2025-49034, you should update FunnelKit Funnel Builder to the latest version beyond 3.10.2.
Which versions of FunnelKit Funnel Builder are affected by CVE-2025-49034?
CVE-2025-49034 affects FunnelKit Funnel Builder versions from n/a through 3.10.2.
What type of vulnerability is CVE-2025-49034?
CVE-2025-49034 is an SQL Injection vulnerability that involves improper neutralization of special elements used in SQL commands.
What should I do if I cannot update my version to fix CVE-2025-49034?
If you cannot update to fix CVE-2025-49034, consider implementing application layer firewalls or input validation measures as temporary mitigations.