Threat Overview
A critical missing authorization vulnerability in FunnelKit Automations (formerly Autonami)—a prominent marketing automation and CRM engine powering over 20,000 active WooCommerce stores—permits unauthenticated remote attackers to install and activate arbitrary plugins. Designated as CVE-2025-1562 with a CVSS 9.8 severity score, the vulnerability allows unauthorized actors to remotely trigger add-on installation handlers, opening an immediate gateway for malicious code execution and e-commerce payment skimming.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.8 / 10.0) |
| Vulnerability Class | Missing Authorization / Arbitrary Plugin Installation (CWE-862) |
| Vulnerable Component | FunnelKit Automations Plugin (versions up to and including 3.3.4) |
| Attack Vector | Unauthenticated AJAX / REST Requests |
The Breakdown: How the Exploit Works
The vulnerability resides within the plugin’s internal add-on installer routine, specifically the install_or_activate_addon_plugins() function.
FunnelKit provides a management interface that allows administrators to install recommended marketing add-ons from the WordPress plugin directory with a single click. When processing this action, the endpoint is registered to handle incoming AJAX and REST requests. However, developers omitted a crucial server-side permission check (current_user_can('install_plugins')) and relied on an insecure nonce validation pattern that can be accessed or bypassed by unauthenticated visitors.
Consequently, an unauthenticated attacker can forge a direct HTTP POST request targeting the add-on handler, passing arbitrary plugin slugs available in the public WordPress repository or manipulating installation URLs. By triggering automated installation and activation of arbitrary extensions, attackers can activate abandoned plugins with known vulnerabilities or chain plugin activation with file-upload vectors to gain instant execution privileges.
The Operational Risk: What an Attacker Gains
In e-commerce environments handling transactions and customer data, unauthenticated plugin installation introduces extreme operational exposure:
- Remote Webshell Injection: Attackers activate vulnerable or backdoored extensions to deploy persistent webshells and seize control of the web server.
- WooCommerce Payment Interception: Infiltrated stores are routinely modified with malicious JavaScript skimmers that silently capture customer credit card numbers during checkout.
Our Take in Plain English
“E-commerce stores carry the highest liability on the web, yet WordPress architecture routinely places marketing automation, customer data, and system-level plugin installers on the same runtime as checkout. When a marketing plugin forgets a permission check, attackers can install new software directly on your production server. On a modern decoupled architecture, storefronts are pre-rendered and static, with checkout isolated to secure payment processors that have no plugin installation capabilities.”
The Modern Architectural Remedy
- Legacy Dynamic WordPress: Grants marketing and automation plugins runtime authority to download, write, and activate code on the live server, exposing core filesystem integrity to unauthenticated API requests.
- Modern Pre-Rendered Architecture: Runs immutable storefronts where the server filesystem is read-only at runtime, preventing the installation or execution of unauthorized third-party scripts.
Immediate Action Items for WordPress Operators
- Update FunnelKit Automations Immediately: Upgrade to version
3.3.5or higher where capability checks have been implemented. - Audit Installed Plugins: Inspect
wp-content/plugins/for newly installed or unfamiliar plugins activated without administrator consent. - Check WooCommerce Checkout Scripts: Review checkout page templates and active scripts for unauthorized third-party domain references or obfuscated JavaScript.