Listen to this Post
How CVE-2025-12468 works:
The vulnerability exists in the FunnelKit Automations plugin for WordPress, all versions up to and including 3.6.4.1. The plugin registers a REST API endpoint at ‘/wc-coupons/’ with the parameter public_api = true. This configuration sets the `permission_callback` to __return_true, a WordPress function that always returns true. Consequently, the endpoint bypasses all authentication and capability checks, making it publicly accessible. Unauthenticated attackers can send HTTP requests, such as GET, to this endpoint. The endpoint then returns sensitive data from the WooCommerce database, including all coupon codes, their unique IDs, and expiration statuses. This information is typically restricted to authorized users like administrators. The core issue is the misconfiguration of the REST API endpoint as public, which should have been protected with proper permission checks. This exposure allows anyone to retrieve coupon details without any credentials, leading to potential misuse.
Platform: FunnelKit Automations WordPress
Version: Up to 3.6.4.1
Vulnerability: Sensitive Information Exposure
Severity: Critical
Date: 2025-11-05
Prediction: After 2025-11-05
What Undercode Say:
Showing bash commands and codes related to the blog
curl -X GET “http://example.com/wp-json/wc-coupons/”
curl -s “http://vulnerable-site.com/?rest_route=/wc-coupons/”
wget -qO- “http://target/wp-json/wc-coupons/”
how Exploit:
Send unauthenticated GET requests to the ‘/wc-coupons/’ REST endpoint to retrieve all coupon data including codes, IDs, and expiration statuses.
Protection from this CVE:
Update plugin immediately. Implement authentication checks. Use security plugins.
Impact:
Coupon code exposure. Potential financial loss. Data breach risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
