CVE-2025-14169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14169", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-05T22:02:13.962Z", "datePublished": "2025-12-12T07:20:35.996Z", "dateUpdated": "2026-04-08T17:34:29.703Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:29.703Z"}, "affected": [{"vendor": "amans2k", "product": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.13.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/admin/db/class-wffn-db-optin.php#L79"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/merge-tags/class-bwf-optin-tags.php#L126"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415550%40funnel-builder%2Ftrunk&old=3414128%40funnel-builder%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-12-05T22:17:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-11T18:43:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T15:48:33.371798Z", "id": "CVE-2025-14169", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:48:46.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14169", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T15:48:33.371798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:48:37.193Z"}}], "cna": {"title": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "amans2k", "product": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.13.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T22:17:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-11T18:43:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/admin/db/class-wffn-db-optin.php#L79"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/merge-tags/class-bwf-optin-tags.php#L126"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415550%40funnel-builder%2Ftrunk&old=3414128%40funnel-builder%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:29.703Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14169", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:29.703Z", "dateReserved": "2025-12-05T22:02:13.962Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T07:20:35.996Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout", "vendor": "amans2k", "versions": [{"lessThanOrEqual": "3.13.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin FunnelKit - Funnel Builder for WooCommerce Checkout para WordPress es vulnerable a inyecci\u00f3n SQL ciega basada en tiempo a trav\u00e9s del par\u00e1metro 'opid' en todas las versiones hasta la, e incluyendo, la 3.13.1.5 debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-14169", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14169", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T15:48:33.371798Z", "version": "2.0.3"}}]}, "published": "2025-12-12T08:15:47.830", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/admin/db/class-wffn-db-optin.php#L79"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/merge-tags/class-bwf-optin-tags.php#L126"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415550%40funnel-builder%2Ftrunk&old=3414128%40funnel-builder%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:50:34.778783+00:00", "value": {"mitigation_remediation": ["Upgrade the FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin to version 3.13.1.6 or later, which removes the vulnerable code block.", "If an immediate upgrade is not feasible, restrict access to the plugin\u2019s optin management functionality by requiring user authentication and verifying that the requester has the appropriate capability before accepting the 'opid' input.", "Patch the vulnerable code by replacing the unsafe string concatenation with parameterized queries or by sanitizing the 'opid' input using whitelisting and proper escaping."], "summary": {"action": "Immediate Patch", "impact": "Remote Data Breach via SQL Injection"}, "threat_synthesis": {"affected_systems": "Vendors: amans2k; Product: FunnelKit \u2013 Funnel Builder for WooCommerce Checkout; Versions affected: all releases up to and including 3.13.1.5.", "description_and_impact": "The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin is vulnerable to a time\u2011based blind SQL Injection through the 'opid' parameter in all releases up to and including 3.13.1.5. The vulnerability arises from insufficient escaping of the user\u2011supplied value and the absence of prepared statements, allowing an attacker to append additional SQL statements to the existing query. This flaw can compromise data confidentiality by enabling the extraction of sensitive information from the WordPress database and can also affect data integrity if the injected statements modify stored data. The weakness is classified as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted 'opid' values to the plugin\u2019s endpoint that processes this parameter; the exact URL is not explicitly provided, but the parameter exists within the plugin\u2019s processing logic. The attack requires a time\u2011based blind approach where the attacker observes response delays to infer the success of injected statements. The ability to append malicious queries enables extraction of sensitive data or modification of database contents, provided the attacker is able to reach the vulnerable endpoint without authentication."}}}}, "created": "2025-12-14T21:16:36.024058+00:00", "updated": "2026-04-21T01:00:12.954820+00:00", "vendors": ["funnelkit", "funnelkit$PRODUCT$funnel_builder", "funnelkit$PRODUCT$funnelkit_checkout", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}