CVE-2025-7654: Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wfgetcookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible. Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7654?
CVE-2025-7654 is considered a high severity vulnerability due to the potential for sensitive information exposure.
How do I fix CVE-2025-7654?
To fix CVE-2025-7654, you should update the FunnelKit Funnel Builder for WooCommerce Checkout and FunnelKit Automations plugins to the latest versions available.
Who is affected by CVE-2025-7654?
Authenticated users with Contributor-level access and above are affected by CVE-2025-7654, as they can exploit the vulnerability.
What sensitive information can be exposed by CVE-2025-7654?
CVE-2025-7654 allows attackers to extract sensitive data, including authentication cookies of other site users.
Which plugins are vulnerable to CVE-2025-7654?
The Vulnerable plugins related to CVE-2025-7654 include FunnelKit Funnel Builder for WooCommerce Checkout and FunnelKit Automations.