Live › vulnerability › CVE-2026-111411
Go to dashboardThe FunnelKit Automations WordPress plugin (wp-marketing-automations) does not neutralize special characters in a database query, which allows blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the FunnelKit Automations WordPress plugin at version or earlier are exposed. The sources do not say which configurations or user roles are required to reach the vulnerable query, so treat any site with the plugin installed as potentially affected.
3.8.5.2No product ranges from the sources yet.
wp plugin get wp-marketing-automations --field=version3.8.5.23.8.5.2; the sources do not name the patched release, so check the vendor changelogEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111411")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.