FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce

Information

Software Type Plugin
Software Slug wp-marketing-automations (view on wordpress.org)
Software Status Active
Software Author teamfunnelkit
Software Website funnelkit.com
Software Downloads 783,609
Software Active Installs 20,000
Software Record Last Updated August 17, 2026

13 Vulnerabilities

Submit a Vulnerability
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization
4.3
CVE-2026-39450
Apr 22, 2026
Researcher: Jakub Herman
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2025-12468
Nov 4, 2025
Researcher: Rafshanzani Suhada
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
4.3
CVE-2025-12469
Nov 4, 2025
Researcher: Rafshanzani Suhada
Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
8.8
CVE-2025-7654
Aug 18, 2025
Researcher: wesley (wcraft)
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
9.8
CVE-2025-1562
Jun 17, 2025
Researcher: mikemyers
Automation By Autonami <= 3.6.0 - Open Redirect
6.1
CVE-2025-49868
Jun 12, 2025
Researcher: LVT-tholv2k
Automation By Autonami <= 3.5.1 - Open Redirect
7.2
CVE-2025-30795
Mar 27, 2025
Researcher: Le Ngoc Anh
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
7.5
CVE-2025-2186
Mar 21, 2025
Researcher: mikemyers
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.2.2 - Unauthenticated SQL Injection
7.5
CVE-2024-9186
Oct 24, 2024
Researcher: y4ng0615
Automation By Autonami <= 3.1.2 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2024-47328
Sep 25, 2024
Researcher: SOPROBRO
Automation By Autonami <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-2580
Mar 18, 2024
Researcher: LVT-tholv2k
Automation By Autonami <= 2.6.1 - Authenticated(Administrator+) SQL Injection
6.6
CVE-2023-50857
Dec 21, 2023
Researcher: Muhammad Daffa
Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization
6.3
CVE-2022-2389
Jul 15, 2022
Researcher: Krzysztof Zając
Title Status CVE ID CVSS Researchers Date
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization Patched CVE-2026-39450 4.3 Jakub Herman April 22, 2026
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure Patched CVE-2025-12468 5.3 Rafshanzani Suhada November 4, 2025
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending Patched CVE-2025-12469 4.3 Rafshanzani Suhada November 4, 2025
Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library Patched CVE-2025-7654 8.8 wesley (wcraft) August 18, 2025
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation Patched CVE-2025-1562 9.8 mikemyers June 17, 2025
Automation By Autonami <= 3.6.0 - Open Redirect Patched CVE-2025-49868 6.1 LVT-tholv2k June 12, 2025
Automation By Autonami <= 3.5.1 - Open Redirect Patched CVE-2025-30795 7.2 Le Ngoc Anh March 27, 2025
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId' Patched CVE-2025-2186 7.5 mikemyers March 21, 2025
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.2.2 - Unauthenticated SQL Injection Patched CVE-2024-9186 7.5 y4ng0615 October 24, 2024
Automation By Autonami <= 3.1.2 - Authenticated (Administrator+) SQL Injection Patched CVE-2024-47328 4.9 SOPROBRO September 25, 2024
Automation By Autonami <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-2580 6.4 LVT-tholv2k March 18, 2024
Automation By Autonami <= 2.6.1 - Authenticated(Administrator+) SQL Injection Patched CVE-2023-50857 6.6 Muhammad Daffa December 21, 2023
Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization Patched CVE-2022-2389 6.3 Krzysztof Zając July 15, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation