CVE-2024-9186
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress sites using the FunnelKit plugin. Attackers can manipulate database queries through the unsanitized bwfan-track-id parameter. All WordPress sites running vulnerable versions of this plugin are affected.
💻 Affected Systems
- FunnelKit (formerly WooFunnels) - WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential for full site takeover via privilege escalation or remote code execution.
Likely Case
Data exfiltration from WordPress database including user credentials, sensitive content, and plugin-specific data.
If Mitigated
Limited impact if proper WAF rules block SQL injection patterns or if database permissions are restricted.
🎯 Exploit Status
SQL injection via bwfan-track-id parameter requires no authentication and has public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.0
Vendor Advisory: https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'FunnelKit' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.3.0+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock SQL injection patterns targeting the bwfan-track-id parameter
WAF-specific configuration required
Temporary Plugin Deactivation
linuxDisable the vulnerable plugin until patched
wp plugin deactivate funnelkit
🧯 If You Can't Patch
- Implement strict WAF rules to block SQL injection patterns
- Restrict database user permissions to SELECT only where possible
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → FunnelKit version number. If version is below 3.3.0, site is vulnerable.Check Version:
wp plugin get funnelkit --field=versionVerify Fix Applied:
Confirm plugin version is 3.3.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- HTTP requests containing bwfan-track-id with SQL syntax
Network Indicators:
- POST/GET requests to WordPress endpoints with SQL injection payloads in bwfan-track-id parameter
SIEM Query:
web.url:*bwfan-track-id* AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT* OR web.query:*UPDATE* OR web.query:*DELETE*)