The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin contains an unauthenticated SQL injection flaw. The flaw arises when a user supplies an unescaped 'automationId' value, which the plugin concatenates directly into an SQL query. This allows an attacker to append arbitrary SQL statements and extract sensitive data from the database, as the plugin fails to perform proper query parameterization or escaping.

Affected systems are all WordPress installations using the FunnelKit Automations plugin up to and including version 3.5.1. The flaw is present in the API endpoint handled by class-bwfan-api-get-automation-dynamic-coupon.php. Any site running the vulnerable version of this plugin is susceptible to exploitation.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only a simple HTTP request to the vulnerable endpoint, meaning the attack vector is remote and unauthenticated, leveraging the lack of authentication checks around the 'automationId' parameter.