Vulnerability feed

Executive summary

A cross-site request forgery flaw exists in the FunnelKit Automations WordPress plugin (wp-marketing-automations) for versions up to and including 3.8.5.2. The advisory says the issue is low priority and unlikely to be exploited, though it lists a CVSS score of 8.8, and the vendor recommends updating to version 3.8.6 or later.

Technical summary

The flaw is a cross-site request forgery (CSRF) vulnerability, classified under OWASP A1 Broken Access Control. Per the advisory, the attack requires user interaction: a logged-in privileged user must be tricked into clicking a malicious link, visiting a crafted page, or submitting a form, and the listed required privilege is Unauthenticated. Vulnerable versions are 3.8.5.2 and earlier, and the patched version is 3.8.6. The advisory recommends updating to 3.8.6 or later, and says that if this is not possible, users should ask their hosting provider or web developer for help. No workarounds beyond updating are stated, and no detection guidance or indicators of exploitation are stated. The advisory also says the CVSS score is not ideal for WordPress and that the issue has a low severity impact.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

AmanFunnelKitAman FunnelKit AutomationsFunnelKit Automations