CVE-2025-12468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12468", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-29T15:28:51.567Z", "datePublished": "2025-11-05T09:27:39.398Z", "dateUpdated": "2026-04-08T16:40:33.889Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:33.889Z"}, "affected": [{"vendor": "amans2k", "product": "FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status."}], "title": "FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.php#L119"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-29T15:44:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T21:17:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T15:43:42.647080Z", "id": "CVE-2025-12468", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:43:54.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T15:43:42.647080Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:43:47.467Z"}}], "cna": {"title": "FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "amans2k", "product": "FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.6.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T15:44:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T21:17:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.php#L119"}], "descriptions": [{"lang": "en", "value": "The FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-05T09:27:39.398Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12468", "state": "PUBLISHED", "dateUpdated": "2025-11-05T15:43:54.382Z", "dateReserved": "2025-10-29T15:28:51.567Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T09:27:39.398Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce", "vendor": "amans2k", "versions": [{"lessThanOrEqual": "3.6.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "3034084D-172A-4FE5-9A23-F7B4F45F4787", "versionEndExcluding": "3.6.4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status."}, {"lang": "es", "value": "El plugin FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 3.6.4.1, inclusive, a trav\u00e9s del endpoint de la API REST '/wc-coupons/'. Esto se debe a que el endpoint est\u00e1 marcado como una API p\u00fablica (public_api = true), lo que resulta en que el endpoint se registra con permission_callback => '__return_true', omitiendo todas las comprobaciones de autenticaci\u00f3n y capacidad. Esto hace posible que atacantes no autenticados extraigan datos sensibles, incluyendo todos los c\u00f3digos de cup\u00f3n de WooCommerce, los IDs de cup\u00f3n y el estado de caducidad."}], "id": "CVE-2025-12468", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12468", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T15:43:42.647080Z", "version": "2.0.3"}}]}, "published": "2025-11-05T10:15:35.463", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-wc-coupons.php#L19"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/class-bwfan-api-loader.php#L119"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:18:59.129244+00:00", "value": {"mitigation_remediation": ["Update FunnelKit Automations to the latest available version, which removes the insecure public API registration. ", "Ensure that the '/wc-coupons/' endpoint is no longer publicly accessible by testing with an unauthenticated request or by checking the plugin's REST API configuration. ", "If a custom or legacy installation requires the endpoint, replace the permission_callback with a proper authentication check or disable the endpoint entirely."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "All installations of FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce up to and including version 3.6.4.1 are affected. Sites running any of these versions with the default REST endpoint configuration are at risk.", "description_and_impact": "The FunnelKit Automations plugin for WordPress and WooCommerce is vulnerable to a sensitive information exposure flaw. The '/wc-coupons/' REST API endpoint is registered as a public API and configured with a permission callback that always returns true. This bypasses all authentication and capability checks, allowing any unauthenticated user to retrieve detailed coupon information, including coupon codes, identifiers, and expiration status. The vulnerability maps to CWE-200 and directly compromises the confidentiality of merchant data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. However, the attack vector is remote, unauthenticated, and requires only a simple HTTP request to the public endpoint. A malicious actor could obtain sensitive coupon data without any user interaction, which could facilitate forgery or other downstream attacks. Prompt remediation is recommended to mitigate the potential confidentiality impact."}}}}, "created": "2025-11-06T10:07:18.262240+00:00", "updated": "2026-04-22T21:30:27.815900+00:00", "vendors": ["funnelkit", "funnelkit$PRODUCT$funnelkit_automations", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}