CVE-2022-2389

MEDIUM

funnelkit_automations < 2.1.2 - Authenticated Missing Authorization via AJAX Action

Title source: llm

Description

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9

Scores

CVSS v3 4.3

EPSS 0.0031

EPSS Percentile 22.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-352 CWE-862

Status published

Products (1)

funnelkit/funnelkit_automations < 2.1.2

Published Aug 22, 2022

Tracked Since Feb 18, 2026