CVE-2025-7654
📋 TL;DR
This vulnerability in FunnelKit plugins allows authenticated attackers with Contributor-level access or higher to extract sensitive data including authentication cookies of other users via the wf_get_cookie shortcode. This could lead to privilege escalation attacks. Both FunnelKit Funnel Builder for WooCommerce Checkout and FunnelKit Automations are affected.
💻 Affected Systems
- FunnelKit – Funnel Builder for WooCommerce Checkout
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to WordPress sites, compromise user accounts, steal sensitive data, and potentially take full control of affected websites.
Likely Case
Authenticated attackers with contributor access steal session cookies and escalate privileges to administrator or editor roles, gaining unauthorized access to sensitive site data.
If Mitigated
With proper access controls and monitoring, impact is limited to potential data exposure from compromised contributor accounts.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once an attacker has Contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Funnel Builder 3.11.0.2+, FunnelKit Automations 3.6.3+
Vendor Advisory: https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.11.0.2/woofunnels/includes/class-bwf-data-tags.php#L52
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Update both FunnelKit Funnel Builder and FunnelKit Automations to latest versions. 4. Verify updates completed successfully.
🔧 Temporary Workarounds
Disable vulnerable shortcode
allRemove or disable the wf_get_cookie shortcode functionality
Edit woofunnels/includes/class-bwf-data-tags.php and comment out or remove the wf_get_cookie shortcode registration
Restrict contributor access
allTemporarily remove Contributor role access until patching
Use WordPress user management to downgrade or remove Contributor roles from untrusted users
🧯 If You Can't Patch
- Implement strict access controls and monitor Contributor-level user activities
- Deploy web application firewall rules to block suspicious shortcode usage
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins for FunnelKit plugin versions. Vulnerable if Funnel Builder < 3.11.0.2 or Automations < 3.6.3.Check Version:
wp plugin list --name=funnel* --field=version (if WP-CLI installed)Verify Fix Applied:
Confirm both plugins show updated versions: Funnel Builder ≥ 3.11.0.2 and Automations ≥ 3.6.3 in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode usage patterns
- Multiple failed authentication attempts followed by successful Contributor login
- Suspicious user role changes
Network Indicators:
- HTTP requests containing wf_get_cookie parameter
- Unusual cookie transmission patterns
SIEM Query:
source="wordpress" AND (plugin_version="funnel-builder" AND version<"3.11.0.2") OR (plugin_version="wp-marketing-automations" AND version<"3.6.3")🔗 References
- https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.11.0.2/woofunnels/includes/class-bwf-data-tags.php#L52
- https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.6.3/woofunnels/includes/class-bwf-data-tags.php#L52
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0983d7-6c7e-41cb-8997-578d362d9c9f?source=cve
