blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-12469

MEDIUM 4.3 CVSS 3.1
Published
November 5, 2025
Last modified
October 18, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content.

Affected WordPress components

  • FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Plugin · wp-marketing-automations
    Confirmed match Active
    Up to and including 3.6.4.1
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce — Up to and including 3.6.4.1
  • funnelkit funnelkit_automations — Before 3.6.4.2

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/abstracts/class-bwfan-ajax-controller.php#L296 Product
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-common.php#L1896 Product
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-public.php#L70 Product
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3388822/wp-marketing-automations/trunk/includes/abstracts/class-bwfan-ajax-controller.php Patch
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/72198b74-90f6-49c6-b261-6f9c1cdc9692?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record