This vulnerability arises from inadequate sanitization of special characters in SQL statements, allowing an attacker to perform blind SQL injection against the FunnelKit Automations plugin. The flaw can enable unauthorized reading, modification, or deletion of database records and may facilitate further exploitation within the database context, potentially leading to data exfiltration or command execution if the database account has elevated privileges.

Aman FunnelKit Automations plugin for WordPress, versions from the earliest available up to and including 3.8.5.2, is affected. Sites running any of these versions should be inspected for the presence of the plugin.

The Common Vulnerability Scoring System assigns a 9.3 severity, indicating a severe exploitation risk. While the EPSS score is not provided, the absence of a CISA KEV listing does not negate the high likelihood of exploitation, especially since the vulnerability permits blind SQL injection via standard HTTP requests to the plugin’s endpoints. An attacker can craft malicious requests to the plugin’s API to manipulate data or extract information, particularly if the WordPress installation allows unauthenticated access to those endpoints.