Medium severity5.3NVD Advisory· Published Nov 5, 2025· Updated Jun 17, 2026
CVE-2025-12468
CVE-2025-12468
Description
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (public_api = true), which results in the endpoint being registered with permission_callback => '__return_true', bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=3.6.4.1
- cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*Range: <3.6.4.2
- amans2k/FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommercev5Range: 0
Patches
Vulnerability mechanics
References
3- www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721anvdThird Party Advisory
- plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.phpnvdProduct
- plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.phpnvdProduct
News mentions
0No linked articles in our index yet.