CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.
Explanation of Vulnerability in Simple Terms
FunnelKit Funnel Builder for WordPress versions up to 2.14.3 contain a SQL injection vulnerability in a high-privilege function. An authenticated admin can craft malicious input to read sensitive data from the WordPress database. The vulnerability requires admin access and does not allow data modification, but can expose customer information, payment details, or other stored records.
What an attacker can do
Read sensitive data from the WordPress database via SQL injection.
Potential impact on your site
A compromised admin account can expose customer data, order records, and other sensitive database contents.
Conditions required to exploit
Attacker must have WordPress admin privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
