This vulnerability (CVE-2026-56052) in Funnel Builder by FunnelKit is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows an attacker with high privileges to perform Blind SQL Injection due to insufficient sanitization of SQL inputs. The affected versions include all versions up to and including 3.15.0.5. The CVSS 3.1 base score is 7.6, indicating a high severity with network attack vector, low attack complexity, required privileges high, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to extract sensitive information from the database via Blind SQL Injection. The confidentiality impact is high, meaning sensitive data could be disclosed. Integrity is not affected, and availability impact is low. Because the attack requires high privileges, the risk is somewhat mitigated by the need for elevated access prior to exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Funnel Builder by FunnelKit installations to trusted users with high privileges only. Monitor for updates from FunnelKit regarding patches or mitigations. Avoid exposing the affected application to untrusted networks or users.