CVE-2025-49868

Executive Summary

CVE-2025-49868 is an Open Redirect vulnerability (CWE-601) affecting the FunnelKit Automations WordPress plugin (slug: wp-marketing-automations) versions up to and including 3.6.0. This flaw allows an attacker to craft a URL that, when clicked by an authenticated or unauthenticated user, redirects them to an arbitrary external domain. The primary risk is phishing, where a legitimate-looking link from the victim’s own site leads to a malicious page. The CVSS score is 4.7 (Medium), with a low EPSS probability (0.0%) indicating limited active exploitation at the time of analysis. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or automated deployment tools (e.g., Composer, WP-CLI) are affected. The plugin’s update mechanism does not yet provide a patched version. Organizations should treat this as a supply chain risk: if the plugin is compromised or abandoned, the open redirect could be used in targeted phishing campaigns against site visitors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Redirect can lead to a different security domain.
• Confidentiality (C): Low (L) – Potential disclosure of redirect destination.
• Integrity (I): Low (L) – Redirected content may be malicious.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS is moderate, the phishing potential makes it a serious concern for WordPress sites with high traffic or sensitive user bases.

Deep Dive & Mechanics

The vulnerability exists in the FunnelKit Automations plugin’s URL handling logic. The plugin likely uses a wp_redirect() or header('Location: ...') call with user-supplied input (e.g., from a redirect_to parameter or a URL in a marketing automation action) without proper validation. An attacker can inject a URL like https://evil.com into the redirect parameter, and the plugin will forward the user to that site.

Root Cause: The plugin fails to validate that the redirect target is within the same origin or a trusted domain. This is a classic open redirect pattern.

Attack Scenario:

1. Attacker identifies a vulnerable endpoint, e.g., https://victim.com/wp-admin/admin-ajax.php?action=funnelkit_redirect&url=https://evil.com.
2. Attacker sends a phishing email with a link like https://victim.com/wp-admin/admin-ajax.php?action=funnelkit_redirect&url=https://evil.com/login.
3. Victim clicks the link, sees the legitimate domain in the URL, and is redirected to a fake login page.
4. Victim enters credentials, which are stolen.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The fix would involve validating the redirect URL against a whitelist of allowed domains or using WordPress’s built-in wp_safe_redirect() function.

Vulnerable Code (Hypothetical):

$redirect_url = $_GET['url'];
wp_redirect($redirect_url);
exit;

Patched Code (Expected):

$redirect_url = $_GET['url'];
$allowed_hosts = array('victim.com', 'sub.victim.com');
$parsed_url = parse_url($redirect_url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    wp_redirect($redirect_url);
} else {
    wp_redirect(home_url());
}
exit;

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with FunnelKit Automations <= 3.6.0 installed and activated.
• A publicly accessible endpoint that accepts a url parameter.

Step-by-Step Exploit:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=funnelkit_redirect&url=
   • /wp-json/funnelkit/v1/redirect?url=
2. Craft a phishing link:

   https://victim.com/wp-admin/admin-ajax.php?action=funnelkit_redirect&url=https://evil.com/fake-login
   

3. Use URL shorteners or email campaigns to deliver the link.
4. Monitor for victims via the evil.com server logs.

Proof-of-Concept (PoC) Script:

import requests

target = "https://victim.com/wp-admin/admin-ajax.php"
params = {
    "action": "funnelkit_redirect",
    "url": "https://evil.com"
}
response = requests.get(target, params=params, allow_redirects=False)
print(f"Status: {response.status_code}")
print(f"Location header: {response.headers.get('Location')}")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to admin-ajax.php with action=funnelkit_redirect and suspicious url parameters.
• Look for Location headers pointing to external domains in responses from the plugin.

Hardening:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests with url parameters containing external domains.
• Use WordPress’s wp_safe_redirect() in custom code if you must keep the plugin.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-admin/admin-ajax.php?action=funnelkit_redirect&url=*
  • /wp-json/funnelkit/v1/redirect?url=*
• HTTP Response Headers:
  • Location: https://evil.com (or any external domain)
• Log Entries:
  • GET /wp-admin/admin-ajax.php?action=funnelkit_redirect&url=https://evil.com
• Network Traffic:
  • Outbound connections to unknown domains immediately following a request to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_49868_Open_Redirect {
    meta:
        description = "Detects open redirect attempts targeting FunnelKit Automations plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-49868"
    strings:
        $action = "action=funnelkit_redirect"
        $url_param = "url="
        $external_domain = /https?:\/\/[^\/]+\.[^\/]+/
    condition:
        $action and $url_param and $external_domain
}

Sigma Rule

title: FunnelKit Automations Open Redirect Attempt
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects HTTP requests to FunnelKit Automations plugin with external redirect URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "action=funnelkit_redirect"
        cs-uri-query|contains: "url=http"
    condition: selection
falsepositives:
    - Legitimate redirects to trusted partners (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49868 FunnelKit Automations Open Redirect"; flow:to_server; content:"action=funnelkit_redirect"; http_uri; content:"url="; http_uri; pcre:"/url=https?:\/\/[^\/]+\.[^\/]+/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply a virtual patch via WAF to block requests with url parameters containing external domains.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Await an official patch from FunnelKit. Once available, update to the latest version.
• If the plugin is abandoned, consider migrating to an alternative automation solution.

Workaround (Code-Level):

• If you must keep the plugin, add a custom filter to validate redirect URLs:

add_filter('funnelkit_redirect_url', function($url) {
    $allowed_hosts = array('yourdomain.com');
    $parsed = parse_url($url);
    if (!in_array($parsed['host'], $allowed_hosts)) {
        return home_url();
    }
    return $url;
});

Valters IT – Securing WordPress ecosystems one CVE at a time.