What the vulnerability does
01Description
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.
Explanation of Vulnerability in Simple Terms
02Summary
FunnelKit Automations versions 3.6.4.1 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve limited confidential data from the plugin without needing to log in or interact with a site user. The vulnerability affects the email marketing and CRM functionality of the plugin.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the plugin without logging in.
Potential impact on your site
04Site Impact
Confidential data stored by FunnelKit Automations may be exposed to unauthenticated attackers.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 5, 2025
CVE published
April 8, 2026
Record updated
