CVE-2025-49034: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-49034) was discovered in the FunnelKit Funnel Builder WordPress plugin affecting versions up to and including 3.10.2. The vulnerability was reported on April 18, 2025, and publicly disclosed on July 8, 2025. The issue was assigned a CVSS score of 7.6 (High) (Patchstack).

The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries in the FunnelKit Funnel Builder plugin. The issue is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability has been assigned a CVSS v3.1 base score of 7.6 with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L (Rapid7, Patchstack).

The vulnerability allows authenticated attackers with administrator-level access to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database (Rapid7).

The vulnerability has been patched in version 3.11.0 of the FunnelKit Funnel Builder plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).