Beveiligingsadvies

CVE-2025-12468

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-11-05 09:27:39

Laatst bijgewerkt 2026-04-08 16:40:33

Toegewezen door Wordfence

CVSS-score 5.3

Status PUBLISHED

Beschrijving

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.

← Alle CVE's bekijken Bekijk op cve.org ↗