The FunnelKit – Funnel Builder for WooCommerce Checkout plugin is vulnerable to a time‑based blind SQL Injection through the 'opid' parameter in all releases up to and including 3.13.1.5. The vulnerability arises from insufficient escaping of the user‑supplied value and the absence of prepared statements, allowing an attacker to append additional SQL statements to the existing query. This flaw can compromise data confidentiality by enabling the extraction of sensitive information from the WordPress database and can also affect data integrity if the injected statements modify stored data. The weakness is classified as CWE‑89.

Vendors: amans2k; Product: FunnelKit – Funnel Builder for WooCommerce Checkout; Versions affected: all releases up to and including 3.13.1.5.

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted 'opid' values to the plugin’s endpoint that processes this parameter; the exact URL is not explicitly provided, but the parameter exists within the plugin’s processing logic. The attack requires a time‑based blind approach where the attacker observes response delays to infer the success of injected statements. The ability to append malicious queries enables extraction of sensitive data or modification of database contents, provided the attacker is able to reach the vulnerable endpoint without authentication.