Cross‑Site Request Forgery (CSRF) is present in the Aman FunnelKit Automations WordPress plugin through version 3.8.5.2. The vulnerability allows an attacker to fabricate requests that a victim’s authenticated browser will execute, potentially enabling the attacker to perform any action that the victim can normally perform in the plugin, such as modifying marketing automation rules or setting. Because the input validation for CSRF tokens is missing, this flaw can result in unauthorized changes to the site’s configuration without the user’s consent. The CVSS score of 8.8 reflects the high severity and potential for widespread impact on data integrity and site functionality.

The affected product is the Aman FunnelKit Automations WordPress plugin, commonly installed as part of the wp‑marketing‑automations suite. Any deployment of this plugin up to and including version 3.8.5.2 is vulnerable; newer releases such as 3.8.6 or later contain the fix.

The CVSS base score of 8.8 indicates a high‑severity threat. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, implying that a known exploit is not yet publicly documented. The likely attack vector is remote: an attacker can embed a crafted link or form that a logged‑in user will unknowingly submit, leveraging their authenticated session to perform privileged actions. Even without a publicly available exploit, the high score suggests that the flaw could be weaponised if an attacker examines traffic to identify request parameters. Administrators should treat this as a high risk until a patch is applied.