The FunnelKit Automations – Email Marketing Automation and CRM plugin for WordPress & WooCommerce suffers from an SQL Injection vulnerability (CWE-89) via the 'automationId' parameter. Insufficient escaping and lack of prepared statements in the SQL query allow unauthenticated attackers to append malicious SQL code, potentially exposing sensitive data. This affects all versions up to and including 3.5.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation guidance is currently provided by the vendor.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the plugin's database. The confidentiality of data is at high risk, but integrity and availability are not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the FunnelKit Automations plugin or restricting access to vulnerable endpoints to trusted users only. Monitoring for updates from the vendor is strongly recommended.