CVE-2026-111411: WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

Q: Which installations should be treated as affected?

FunnelKit Automations versions through 3.8.5.2 are affected. The affected plugin slug is wp-marketing-automations.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the potential impact of exploitation?

The vulnerability permits blind SQL injection. The supplied severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

Published Oct 28, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

Affected Software

1 affected component

Aman FunnelKit Automations<=3.8.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FunnelKit Automations plugin to a version that resolves this vulnerability.
Fixed in 3.8.6

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be treated as affected?

FunnelKit Automations versions through 3.8.5.2 are affected. The affected plugin slug is wp-marketing-automations.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the potential impact of exploitation?

The vulnerability permits blind SQL injection. The supplied severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

CVE-2026-111411: WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations should be treated as affected?

Does exploitation require authentication or user interaction?

What is the potential impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be treated as affected?

Does exploitation require authentication or user interaction?

What is the potential impact of exploitation?