This vulnerability allows unauthenticated attackers to inject arbitrary SQL through the bwfan_cart_id parameter during a guest checkout. The injection is only executed when a scheduled job processes order status changes, giving the attacker a persistence window. Successful exploitation can result in extraction of sensitive database contents, leading to data compromise.

The issue exists in the FunnelKit Automations – Email Marketing Automation and CRM plugin for WordPress and WooCommerce, affecting all versions up to and including 3.8.5.2. WordPress sites running this plugin are at risk.

The CVSS score of 7.5 indicates high severity. The vulnerability does not yet appear in CISA KEV, and EPSS is not available. Attackers can target publicly accessible checkout endpoints; the vector requires only knowledge of a WooCommerce cart nonce, which can be obtained by an attacker from a guest session. Once the bad payload is stored in meta, the scheduled Action Scheduler job will trigger the injection, allowing data extraction. The lack of input sanitization makes exploitation straightforward.