CVE-2024-9186 Automation By Autonami < 3.3.0 - Unauthenticated SQLi
Unauthenticated attackers can perform SQL injection via the bwfan-track-id parameter in the FunnelKit WordPress plugin, potentially accessing or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9186?
CVE-2024-9186 is a high-severity SQL injection vulnerability in Unknown Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit, published on 14 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Weakness: CWE-89
Which versions are affected by CVE-2024-9186?
It affects 1 product.
Products include Funnelkit Funnelkit Automations.
How do I fix CVE-2024-9186?
No fix has been published for CVE-2024-9186 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-9186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9186 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- CVE-2025-1562 Missing authorization in FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- CVE-2024-47328 SQL injection in FunnelKit Automations
- CVE-2023-50857 WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection
- CVE-2025-12468 Information disclosure in FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- CVE-2025-12469 Missing authorization in FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Sources
Also known as GHSA-v5rm-528g-7mvp.