FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Security & Risk Analysis

The "wp-marketing-automations" plugin v3.7.3 exhibits a mixed security posture. While a significant portion of its code uses prepared statements for SQL queries and properly escapes output, there are notable areas of concern. The plugin has a substantial attack surface, with 213 total entry points, of which 22 are unprotected. This lack of authentication checks on a considerable number of AJAX handlers and REST API routes presents a significant risk for unauthorized access and potential manipulation of plugin functionalities. The presence of unsanitized paths in taint analysis flows, particularly those with high severity, indicates potential vulnerabilities like path traversal or file manipulation, even though no critical severity flows were identified. The plugin's vulnerability history, with 11 known CVEs including one critical and three high severity issues, further exacerbates these concerns. The common vulnerability types (sensitive information exposure, missing authorization, open redirect, SQL injection, XSS) are classic indicators of fundamental security flaws that have repeatedly appeared. While the absence of currently unpatched CVEs is positive, the pattern of past vulnerabilities suggests a recurring need for rigorous security auditing and patching cycles. Overall, while some good practices are in place, the high number of unprotected entry points, concerning taint analysis results, and persistent vulnerability history necessitate caution.