External risk intelligence

FunnelKit Automations SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111411

This vulnerability exists in a WordPress plugin. WordPress sites and their plugins are commonly deployed as public-facing web applications, making the underlying code reachable and accessible from the internet by design for standard web traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Aman FunnelKit Automations plugin for WordPress, specifically related to SQL injection. This type of flaw can allow attackers to manipulate database queries, potentially leading to unauthorized access or modification of information stored within the application. The main concern at this time is to confirm if this plugin is in use and ascertain the extent of any potential exposure.

Input manipulation allows database access.
Affects WordPress sites using FunnelKit Automations.
Confirm use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to a web application that uses the affected plugin. This input could be processed in a way that allows the attacker to inject malicious SQL commands, potentially leading to unauthorized access to or manipulation of the application's database.

Requires unauthenticated network access.
Triggered by specially crafted user input.
Allows database compromise and data exposure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands through the Aman FunnelKit Automations plugin. This could lead to the disclosure of sensitive database information or unexpected service behavior.

Database information at risk.
Exploited via crafted web requests.
Potential for data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Aman FunnelKit Automations impacts its WordPress plugin, suggesting that WordPress administrators, application owners, and infrastructure teams are primarily responsible for remediation. The first actionable step is to identify all instances of the affected plugin, determine their internet reachability and business criticality, and then assign ownership for planning the necessary updates.

Application owners should verify plugin instances.
Confirm public-facing plugin reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Aman FunnelKit Automations plugin?

FunnelKit Automations is a WordPress plugin designed to help site owners create marketing workflows, such as automated email campaigns and user engagement funnels. By managing customer data and tracking interactions within the WordPress database, it acts as a central hub for site marketing activities.

What does SQL injection mean for CVE-2026-111411?

This vulnerability is classified as CWE-89, or SQL Injection. It occurs when a program fails to properly sanitize user-provided data before including it in a database query. Because of this flaw, the affected plugin can be tricked into running unauthorized database commands, potentially exposing sensitive information stored by the site.

How is this SQL injection vulnerability triggered?

An attacker triggers this flaw by sending specially crafted web requests to the site. The plugin incorrectly processes this input, allowing malicious SQL commands to be executed. Importantly, this vulnerability does not require the attacker to have a user account or login privileges to the WordPress site.

Is my WordPress site at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is considered likely to be reachable because WordPress plugins are typically designed to be accessible via the internet. If you use the affected version of FunnelKit Automations on a public-facing site, your database may be accessible to unauthorized remote actors.

What should I do if I use this plugin?

You should first confirm which WordPress sites in your environment have this plugin installed. Once identified, evaluate the criticality of those sites and monitor for official updates from the vendor to resolve the flaw. Prioritize remediation for instances that are reachable from the public internet.

References

patchstack.com/database/wordpress/plugin/wp-marketing-automations/vu…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.