What’s Vulnerable › Vulnerabilities

CVE-2022-2389: Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-22 · updated 2026-06-17
• Weakness: CWE-352

Description

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations

Affected products

• amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: before 2.1.2 — fixed in 2.1.2

How to fix

Upgrade to a fixed version: amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce 2.1.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9
• https://wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9

Get alerted when CVE-2022-2389 or the next vulnerability affects your stack