CVE-2026-119163

Name of the Vulnerable Software and Affected Versions FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce versions prior to 3.8.5.3

Description An issue exists where unauthenticated attackers can perform a time-based SQL Injection, a technique used to infer data from a database by observing the time it takes for the server to respond to specific queries. This occurs due to insufficient escaping of user-supplied input and lack of preparation in the SQL query. The attack is a two-step persisted process: an attacker submits a crafted bwfan cart id value during a guest Store API checkout, and the injection is executed when a scheduled Action Scheduler job reloads the stored meta during an order status transition. This can be used to extract sensitive information from the database.

Recommendations Update FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce to version 3.8.5.3 or later. As a temporary mitigation, avoid using the bwfan cart id parameter in the Store API checkout process.