CVE-2025-12468: Funnelkit Automations

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.

Affected products

• Funnelkit Funnelkit Automations: before 3.6.4.2 (fixed in 3.6.4.2)

Published 2025-11-05. Last modified 2026-06-17.