FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.6.1 - Unauthenticated PHP Object Injection via Abandoned Cart Checkout Fields
- ID
- WPSEC-2026-1917
- Plugin
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce (wp-marketing-automations)
- Affected
- all versions before 3.8.6.2
- Remediation
- Update to 3.8.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The FunnelKit Automations plugin for WordPress is vulnerable to PHP Object Injection via the abandoned cart capture ('checkout_fields_data') in all versions up to, and including, 3.8.6.1, due to deserialization of untrusted input. Checkout field values are stored with only sanitize_text_field(), which leaves PHP-serialized strings intact. When the cart is marked abandoned, the address, city and postcode values are saved as CRM contact fields, and those values are later passed to maybe_unserialize() whenever the contact is loaded. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1917/
- https://plugins.svn.wordpress.org/wp-marketing-automations/tags/3.8.6.2/
- https://wordpress.org/plugins/wp-marketing-automations/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS