CVE

CVE-2024-9186

8.6

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Attack Vector

Network

Privileges Req.

None

User Interaction

None

recover woocommerce cart abandonment, newsletter, email marketing, marketing automation by funnelkitfunnelkit_automations

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2024-9186 Scanner

CVE-2024-9186 Scanner - SQL Injection vulnerability in FunnelKit Automation By Autonami

Used 2.4k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: recover woocommerce cart abandonment, newsletter, email marketing, marketing automation by funnelkit

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →