What’s Vulnerable › Vulnerabilities
CVE-2026-111411: WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-30
- Weakness: CWE-89
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Summary
FunnelKit Automations for WordPress and WooCommerce, versions through 3.8.5.2, contains a blind SQL injection vulnerability (CVE-2026-111411) rated 9.3 critical. An attacker could inject SQL commands to extract database contents, potentially exposing sensitive site and customer data. The flaw is not listed in CISA KEV and no active exploitation has been reported. Update the plugin to version 3.8.6 or later to remediate.
تحتوي إضافة FunnelKit Automations لـ WordPress وWooCommerce، في الإصدارات حتى 3.8.5.2، على ثغرة حقن SQL أعمى (CVE-2026-111411) بتقييم 9.3 حرج. قد يتمكن المهاجم من حقن أوامر SQL لاستخراج محتويات قاعدة البيانات، مما قد يكشف بيانات الموقع والعملاء الحساسة. الثغرة غير مدرجة في CISA KEV ولم يُبلَّغ عن استغلال نشط لها. يجب تحديث الإضافة إلى الإصدار 3.8.6 أو أحدث لمعالجة المشكلة.
Affected products
- amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: through 3.8.5.2 — fixed in 3.8.6
How to fix
Upgrade to a fixed version: amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce 3.8.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-111411 or the next vulnerability affects your stack