CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Explanation of Vulnerability in Simple Terms
FunnelKit Recover contains a SQL injection vulnerability in versions up to 2.6.1. An authenticated user with high privileges can inject malicious SQL code through unfiltered input, potentially reading sensitive data from the WordPress database. The vulnerability affects the plugin's core functionality and may impact site availability.
What an attacker can do
Read sensitive data from the WordPress database; cause partial site unavailability.
Potential impact on your site
Unauthorized access to customer data, cart information, and email lists; potential database corruption.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
