CVE-2026-42381

Vulnerability

Funnel Builder by FunnelKit versions up to and including 3.15.0.1 are vulnerable to an unauthenticated SQL injection attack. The vulnerability allows a remote attacker to inject arbitrary SQL queries without requiring any authentication or user interaction. The affected plugin is widely used for building sales funnels in WordPress.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable endpoint. No authentication or prior access is needed. The attacker's requests are processed by the plugin without proper sanitization, allowing SQL commands to be executed directly against the WordPress database.

Impact

Successful exploitation enables an attacker to directly interact with the database, including reading, modifying, or deleting sensitive data. This could lead to complete information disclosure, privilege escalation, or full site compromise. The vulnerability is considered highly dangerous and is expected to be used in mass-exploit campaigns.

Mitigation

The vulnerability is fixed in version 3.15.0.2. Users should update immediately. Patchstack has issued a mitigation rule to block attacks until the update is applied. If unable to update, contact your hosting provider or web developer for assistance [1].