FunnelKit Automations: Blind SQL Injection (CVE-2026-111411)
NVD has published CVE-2026-111411 for the WordPress plugin FunnelKit Automations (wp-marketing-automations). It is an improper neutralization of special elements in SQL commands, allowing Blind SQL Injection. The CVSS score is 9.3.
Checked in Shield: no
Who is affected
WordPress sites running FunnelKit Automations up to and including version 3.8.5.2.
How to check
In the WordPress admin, open the Plugins page and find FunnelKit Automations. If the installed version is 3.8.5.2 or lower, the site falls within the described range.
How to fix
The description does not name a fixed version. Watch for an update from the plugin developer and install it as soon as it is released.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Patch availability and any exploitation in the wild are not disclosed yet; source: the NVD entry for CVE-2026-111411.
