FunnelKit Automations vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. PHP object injection

   In some setups, someone could make your server run code.

   Score 9.8 (critical)no login neededAffected: older than 3.8.6.2Fixed in 3.8.6.2Published 30 October 2026CVE-2026-39738

   Advisory: Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.

2. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.3 (critical)no login neededAffected: older than 3.8.6Fixed in 3.8.6Published 28 October 2026CVE-2026-111411

   Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit...

3. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 3.8.6Fixed in 3.8.6Published 26 October 2026CVE-2026-119163

   Advisory: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and...

4. Cross-site request forgery

   Someone could trick a logged-in admin into making a change.

   Score 8.8 (high)no login neededAffected: older than 3.8.6Fixed in 3.8.6Published 22 April 2026CVE-2026-111841

   Advisory: Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

5. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 7.1 (high)needs only a customer accountAffected: older than 3.8.0Fixed in 3.8.0Published 22 April 2026CVE-2026-39450

   Advisory: Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

6. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.8 (high)needs only a customer accountAffected: older than 3.6.4Fixed in 3.6.4Published 18 August 2025CVE-2025-7654

   Advisory: Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode.

7. Missing permission check

   An action that should need permission could be done without it.

   Score 9.8 (critical)no login neededAffected: older than 3.6.0Fixed in 3.6.0Published 17 June 2025CVE-2025-1562

   Advisory: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability...

8. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 3.5.2Fixed in 3.5.2Published 21 March 2025CVE-2025-2186

   Advisory: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and...

9. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 8.6 (high)no login neededAffected: older than 3.3.0Fixed in 3.3.0Published 24 October 2024CVE-2024-9186

   Advisory: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a...

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find FunnelKit Automations. The version number is under its name. If it is lower than 3.8.6.2, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/wp-marketing-automations/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update FunnelKit Automations to 3.8.6.2 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use FunnelKit Automations.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use FunnelKit Automations, delete it instead of leaving it deactivated.

Questions

Which FunnelKit Automations version fixes it?

Version 3.8.6.2 or newer fixes all 9 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs FunnelKit Automations older than 3.8.6.2. In WordPress, open Plugins and read the version under FunnelKit Automations. Without logging in, open yourstore.com/wp-content/plugins/wp-marketing-automations/readme.txt and read the Stable tag line.

I don't use FunnelKit Automations any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.