PT-2025-50901 · Unknown+1 · Woocommerce+1

Marcin Dudek · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-14169

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress versions through 3.13.1.5

Description The software is susceptible to a time-based blind SQL Injection issue via the opid parameter. This is due to inadequate input sanitization and insufficient query preparation. An unauthenticated attacker can inject additional SQL queries into existing database queries, potentially extracting sensitive information.

Recommendations Versions prior to 3.13.1.5 should be updated.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-14169

Affected Products

Funnelkit

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14169 · Security Note
• https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/admin/db/class-wffn-db-optin.php#L79 · Note
• https://twitter.com/cracbot/status/2001246058010321095 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415550%40funnel-builder%2Ftrunk&old=3414128%40funnel-builder%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/39598 · Telegram Post
• https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5/modules/optins/merge-tags/class-bwf-optin-tags.php#L126 · Note
• https://t.me/cveNotify/145571 · Telegram Post