CVE-2025-2186
Published: 22 March 2025
Summary
CVE-2025-2186 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2186 is a SQL injection vulnerability in the Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress. It affects all versions up to and including 3.5.1 and stems from insufficient escaping of the user-supplied 'automationId' parameter combined with inadequate preparation of the underlying SQL query. This flaw, classified under CWE-89, has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability disruption.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges required. By appending malicious SQL queries to existing ones via the 'automationId' parameter, they can extract sensitive information from the database, such as user data, orders, or other confidential records hosted by the WordPress site.
Advisories and references, including Wordfence threat intelligence and WordPress plugin trac details, point to mitigation through patching. A fix is available in changeset 3257474, which addresses the issue in the affected API endpoint file (class-bwfan-api-get-automation-dynamic-coupon.php at line 50). Security practitioners should update the plugin beyond version 3.5.1 and review database access logs for signs of exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7277
Vulnerability details
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied…
more
parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of web application (T1190) and direct extraction of data from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient escaping and preparation of the 'automationId' parameter by requiring validation of user-supplied inputs to prevent SQL injection.
Mandates timely remediation of the specific SQL injection flaw in FunnelKit plugin versions up to 3.5.1 through patching as recommended in advisories.
Enables vulnerability scanning to identify SQL injection vulnerabilities like CVE-2025-2186 in WordPress plugins for proactive mitigation.