Summary
CVE-2026-42381 is a critical unauthenticated SQL injection vulnerability affecting the Funnel Builder by FunnelKit WordPress plugin in all versions up to and including 3.15.0.1, carrying a CVSS v3.1 base score of 9.3. The flaw enables any remote, unauthenticated attacker to inject arbitrary SQL commands and exfiltrate sensitive data directly from the WordPress database — including customer PII, WooCommerce order records, and stored credentials. With the plugin deployed across 40,000+ public-facing WooCommerce storefronts, the potential exposure is significant.
Technical details
- Root cause: Insufficient escaping of user-supplied input and improper SQL query preparation within the plugin, classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
- Trigger conditions: No authentication, account privileges, or user interaction are required. Any remote attacker who can send HTTP requests to the target site can trigger the vulnerability.
- Attack vector: Network-accessible over standard HTTP/HTTPS; low attack complexity; the plugin’s endpoint is reachable from the public internet on any WordPress site running the affected version.
- Impact: Successful exploitation grants read access to the full WordPress database, enabling extraction of customer personally identifiable information (PII), WooCommerce order data, payment-related records, and hashed or stored credentials. The Changed Scope (S:C) indicator reflects that the impact extends beyond the plugin itself to the broader database and application context.
Affected software
- Funnel Builder by FunnelKit (WordPress Plugin) — all versions up to and including 3.15.0.1
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Mitigation and recommended actions
- Immediate: Update the Funnel Builder by FunnelKit plugin to version 3.15.0.2 or later. The patch addressing this vulnerability was released in version 3.15.0.2. The latest available version on WordPress.org is 3.15.0.5.
- After patching, review database access logs and WooCommerce order data for signs of unauthorized queries during the vulnerability window.
- If immediate patching is not possible, consider disabling the plugin temporarily or deploying WAF rules to block unsanitized SQL input to the plugin’s network-accessible endpoints.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

