FunnelKit Automations WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the FunnelKit Automations WordPress plugin, specifically in versions through 3.6.4.1. The issue arises in the '/wc-coupons/' REST API endpoint, which is publicly accessible and lacks proper authentication and capability checks. This vulnerability enables unauthenticated attackers to retrieve sensitive data, including WooCommerce coupon codes, IDs, and expiration statuses.

Impact

Exploitation of this vulnerability allows unauthenticated users to access sensitive WooCommerce coupon information, including codes, IDs, and expiration statuses.

Remediation

Users can update to FunnelKit Automations version 3.6.4.2 or a newer patched version to address this vulnerability.