{"id":"CVE-2026-111411","kind":"vulnerability","aliases":["CVE-2026-111411"],"related":[],"title":"FunnelKit Automations WordPress plugin: blind SQL injection through version 3.8.5.2","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.","summary":"The FunnelKit Automations WordPress plugin (wp-marketing-automations) does not neutralize special characters in a database query, which allows blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and credentials.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing-automation","package","self-hosted","wordpress","wp-plugin"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed FunnelKit Automations plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-marketing-automations --field=version`\n- Compare the result against the affected range, which runs through `3.8.5.2`","fix":"- Update FunnelKit Automations (wp-marketing-automations) to a version later than `3.8.5.2`; the sources do not name the patched release, so check the vendor changelog\n- If no patched release is available, disable the plugin until one is","status":"open","published_at":"2026-10-28T13:17:04+00:00","first_seen_at":"2026-10-28T13:33:00+00:00","triaged_at":"2026-10-28T13:33:56+00:00","updated_at":"2026-10-28T13:33:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T13:33:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update FunnelKit Automations (wp-marketing-automations) to a version later than `3.8.5.2`; the sources do not name the patched release, so check the vendor changelog\n- If no patched release is available, disable the plugin until one is","reach":"internet","title":"FunnelKit Automations WordPress plugin: blind SQL injection through version 3.8.5.2","impact":"high","summary":"The FunnelKit Automations WordPress plugin (wp-marketing-automations) does not neutralize special characters in a database query, which allows blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and credentials.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","self-hosted","marketing-automation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads site database contents, including user records and credentials","analyst_note":"Confirm the affected version range and patched release, and whether unauthenticated access is required, at https://nvd.nist.gov/vuln/detail/CVE-2026-111411 and the vendor's plugin page.","how_to_check":"- Check the installed FunnelKit Automations plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-marketing-automations --field=version`\n- Compare the result against the affected range, which runs through `3.8.5.2`","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the FunnelKit Automations WordPress plugin at version `3.8.5.2` or earlier are exposed. The sources do not say which configurations or user roles are required to reach the vulnerable query, so treat any site with the plugin installed as potentially affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000657,"input_tokens":3326,"output_tokens":649,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111411':13A,16A '-2026':12A,15A '3.8.5.2':10A,105C 'affect':99C 'allow':47B,94C 'aman':87C 'attack':52B 'autom':2A,19B,30B,36B,89C,93C,101C 'blind':5A,48B,95C 'charact':41B 'command':82C 'credenti':72B 'cve':11A,14A 'data':55B 'databas':44B,60B 'element':77C 'expos':68B 'funnelkit':1A,29B,88C,100C 'host':23B 'improp':73C 'infer':62B 'inject':7A,50B,84C 'injection.this':97C 'issu':98C 'market':18B,35B,92C 'marketing-autom':17B 'n/a':103C 'neutral':39B,74C 'one':61B 'packag':20B 'plugin':4A,27B,32B 'queri':45B 'read':54B 'record':70B 'self':22B 'self-host':21B 'site':58B 'special':40B,76C 'sql':6A,49B,81C,83C,96C 'time':65B 'use':78C 'user':69B 'version':9A 'vulner':85C 'wordpress':3A,24B,31B 'wp':26B,34B,91C 'wp-marketing-autom':33B,90C 'wp-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FunnelKit Automations WordPress plugin at version `3.8.5.2` or earlier are exposed. The sources do not say which configurations or user roles are required to reach the vulnerable query, so treat any site with the plugin installed as potentially affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111411","severity":null,"published_at":"2026-10-28T13:17:04+00:00","modified_at":"2026-10-28T13:17:04+00:00","first_seen_at":"2026-10-28T13:33:00+00:00","fetched_at":"2026-10-28T13:33:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}