Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible. Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Funnel Builder Plugin | — | Update funnel-builder plugin to version 3.11.1, or a newer patched version | Aug 19, 2025 | Aug 18, 2025 |
| Wp Marketing Automations Plugin | — | Update wp-marketing-automations plugin to version 3.6.4, or a newer patched version | Aug 19, 2025 | Aug 18, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub