CVE-2025-14169 is a SQL Injection vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. The issue arises from improper neutralization of special elements in the 'opid' parameter, enabling attackers to append malicious SQL queries. This vulnerability affects all versions up to and including 3.13.1.5. It is a time-based blind SQL Injection, allowing attackers to extract sensitive data from the database without authentication. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. The attacker can perform time-based blind SQL Injection attacks remotely without authentication, potentially compromising confidentiality. There is no impact on integrity or availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users of the FunnelKit – Funnel Builder for WooCommerce Checkout plugin should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until a patch is available, consider disabling or restricting access to the vulnerable plugin to mitigate risk.