The vulnerability arises from the wf_get_cookie shortcode present in multiple FunnelKit plugins. When an authenticated user with Contributor-level access or higher executes the shortcode, the plugin exposes authentication cookies belonging to other site users. This sensitive data exposure allows the attacker to obtain credentials for other accounts, potentially leading to privilege escalation. The flaw is classified as CWE‑200, Sensitive Data Exposure.

Affected products are FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce and FunnelKit – Funnel Builder for WooCommerce Checkout. No specific affected version ranges are provided in the available data.

The CVSS score of 8.8 indicates high severity. EPSS is <1%, implying that the probability of exploitation at present is low, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires a local authenticated context; the attacker must already have Contributor-level access to the WordPress site. Once the shortcode is used, the attacker can retrieve other users’ authentication cookies. If those cookies are valid or can be replayed, the attacker could access privileged areas of the site, effectively escalating privileges.