FunnelKit WooCommerce Cart Abandonment Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress. This vulnerability exists in all versions through 3.5.1 and allows unauthenticated attackers to exploit the 'automationId' parameter. The issue arises from inadequate escaping of user-supplied data and insufficient preparation of the SQL query, enabling attackers to inject additional SQL commands that could extract sensitive information from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate SQL queries to access or modify database information. In this case, it could lead to unauthorized data extraction.

Remediation

Users are advised to update the plugin to version 3.5.2 or a newer patched version.