The FunnelKit Automations plugin for WordPress and WooCommerce is vulnerable to a sensitive information exposure flaw. The '/wc-coupons/' REST API endpoint is registered as a public API and configured with a permission callback that always returns true. This bypasses all authentication and capability checks, allowing any unauthenticated user to retrieve detailed coupon information, including coupon codes, identifiers, and expiration status. The vulnerability maps to CWE-200 and directly compromises the confidentiality of merchant data.

All installations of FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce up to and including version 3.6.4.1 are affected. Sites running any of these versions with the default REST endpoint configuration are at risk.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. However, the attack vector is remote, unauthenticated, and requires only a simple HTTP request to the public endpoint. A malicious actor could obtain sensitive coupon data without any user interaction, which could facilitate forgery or other downstream attacks. Prompt remediation is recommended to mitigate the potential confidentiality impact.