CVE-2025-12468

Description

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.

PUBLISHED Reserved 2025-10-29 | Published 2025-11-05 | Updated 2025-11-05 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Rafshanzani Suhada finder

References

www.wordfence.com/...-3d39-4195-8e6c-ab884164721a?source=cve

plugins.trac.wordpress.org/...class-bwfan-api-wc-coupons.php

plugins.trac.wordpress.org/...des/class-bwfan-api-loader.php

cve.org (CVE-2025-12468)

nvd.nist.gov (CVE-2025-12468)

Download JSON