CVE-2026-119163: FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it during a guest WooCommerce Store API checkout. The attacker needs only a publicly obtainable WooCommerce cart nonce and does not need an account or elevated privileges.

Q: Does the SQL injection execute immediately when the crafted value is submitted?

No. The attack is persisted: the crafted bwfan_cart_id value is stored during checkout, and the SQL injection executes later when a scheduled Action Scheduler job reloads that stored metadata after the order status changes out of pending, failed, or cancelled.

Q: What conditions make a site exposed?

Exposure applies to WordPress sites using FunnelKit Automations versions up to and including 3.8.5.2, where guest Store API checkout is available and the affected order-status transition triggers the scheduled job.

Q: What information could be at risk?

The vulnerability can be used to append SQL queries to an existing query and extract sensitive information from the WordPress database. The provided data does not identify specific tables or records that may be accessed.

Published Oct 31, 2026

Updated

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfancartid' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfancartid value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it during a guest WooCommerce Store API checkout. The attacker needs only a publicly obtainable WooCommerce cart nonce and does not need an account or elevated privileges.

Does the SQL injection execute immediately when the crafted value is submitted?

No. The attack is persisted: the crafted bwfan_cart_id value is stored during checkout, and the SQL injection executes later when a scheduled Action Scheduler job reloads that stored metadata after the order status changes out of pending, failed, or cancelled.

What conditions make a site exposed?

Exposure applies to WordPress sites using FunnelKit Automations versions up to and including 3.8.5.2, where guest Store API checkout is available and the affected order-status transition triggers the scheduled job.

What information could be at risk?

The vulnerability can be used to append SQL queries to an existing query and extract sensitive information from the WordPress database. The provided data does not identify specific tables or records that may be accessed.

CVE-2026-119163: FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

Does the SQL injection execute immediately when the crafted value is submitted?

What conditions make a site exposed?

What information could be at risk?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does the SQL injection execute immediately when the crafted value is submitted?

What conditions make a site exposed?

What information could be at risk?