CVE-2026-111411

{
  "etk_id": "ETK-2026-2868",
  "cve_id": "CVE-2026-111411",
  "display_id": "CVE-2026-111411",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-112065",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Blind SQL injection in wp-marketing-automations",
  "summary": "FunnelKit Automations installations using wp-marketing-automations through version 3.8.5.2 are affected by a blind SQL injection vulnerability. An unauthenticated remote attacker may be able to influence database queries where the vulnerable functionality is exposed.",
  "mitigation": "Disable the affected plugin until an updated release from the vendor is available. Restrict public access to the WordPress site or affected functionality where disabling the plugin is not immediately possible.",
  "vendor": "Aman",
  "product": "FunnelKit Automations",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.8.5.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "wp-marketing-automations",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.4005410833333333,
  "t0_at": "2026-10-28T13:00:13.279000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T13:36:14.041410+00:00",
      "days": 0.025008824189814816,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T13:00:13.279000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T13:00:13.279000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T13:00:13.279000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111411"
    }
  }
}