What the vulnerability does
01Description
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content.
Explanation of Vulnerability in Simple Terms
02Summary
FunnelKit Automations for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability affects versions up to 3.6.4.1. Site owners should update the plugin to a version newer than 3.6.4.1.
What an attacker can do
03Attacker Capabilities
A low-privilege user can modify data they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users may alter plugin settings, automation rules, or customer data without proper access controls.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
November 5, 2025
CVE published
April 8, 2026
Record updated
