CVE-2025-12469
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The FunnelKit Automations plugin for WordPress and WooCommerce up to 3.6.4.1 is vulnerable to Missing Authorization in the bwfan_test_email AJAX handler. The nonce is publicly exposed to all visitors, and check_nonce() accepts low-privilege authenticated users. This allows authenticated attackers with Subscriber-level access to send arbitrary emails from the site.
Risk Assessment
A low-privilege attacker can abuse the site to send spam or phishing messages, damaging domain reputation. It may also be used to deliver malicious content to recipients.
Recommendation
Update FunnelKit Automations to a version later than 3.6.4.1. Until then, restrict access to the bwfan_test_email AJAX action and verify permissions and nonce handling.
Other vulnerabilities in FunnelKit Automations
See all- CVE-2026-39450High
There is a broken authentication issue for subscribers in FunnelKit Automations versions <= 3.7.3.
- CVE-2025-12468Medium
The FunnelKit Automations plugin for WordPress and WooCommerce in versions up to and including 3.6.4.1 is vulnerable to Sensitive Information Exposure via the '/wc-coupons/' REST API endpoint. The endpoint is marked as public (public_api = true) and registered with permission_callback => '__return_true', bypassing authentication and capability checks. This allows unauthenticated attackers to extract WooCommerce coupon codes, coupon IDs, and expiration status.
Original NVD description (English source)
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS