https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:55:08 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-13236 cnvd-2026-13236 https://cve.radiocsirt.org/vuln/cnvd-2026-13236 https://cve.radiocsirt.org/vuln/euvd-2026-282318 EUVD-2026-282318 https://cve.radiocsirt.org/vuln/euvd-2026-282318 https://cve.radiocsirt.org/vuln/fkie_cve-2025-12468 <p>The FunnelKit Automations – Email Marketing Automation and CRM for WordPress &amp; WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the &#39;/wc-coupons/&#39; REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback =&gt; &#39;__return_true&#39;`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.</p> <p>The FunnelKit Automations – Email Marketing Automation and CRM for WordPress &amp; WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the &#39;/wc-coupons/&#39; REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback =&gt; &#39;__return_true&#39;`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-12468 https://cve.radiocsirt.org/vuln/ghsa-w6ph-hrmj-vffx <p>The FunnelKit Automations – Email Marketing Automation and CRM for WordPress &amp; WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the &#39;/wc-coupons/&#39; REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback =&gt; &#39;__return_true&#39;`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.</p> <p>The FunnelKit Automations – Email Marketing Automation and CRM for WordPress &amp; WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the &#39;/wc-coupons/&#39; REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback =&gt; &#39;__return_true&#39;`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.</p> https://cve.radiocsirt.org/vuln/ghsa-w6ph-hrmj-vffx