https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T16:16:21.076787+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2026-13236 cnvd-2026-13236 2026-10-05T16:16:21.137618+00:00 cnvd-2026-13236 https://cve.radiocsirt.org/vuln/euvd-2026-282318 EUVD-2026-282318 2026-10-05T16:16:21.137658+00:00 EUVD-2026-282318 https://cve.radiocsirt.org/vuln/fkie_cve-2025-12468 fkie_cve-2025-12468 2026-10-05T16:16:21.137672+00:00

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.

 https://cve.radiocsirt.org/vuln/ghsa-w6ph-hrmj-vffx GHSA-w6ph-hrmj-vffx 2026-10-05T16:16:21.137709+00:00

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.