Quick answers
- Is CVE-2026-111411 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111411 being exploited in the wild.
- How severe is CVE-2026-111411?
- Critical severity, with a CVSS score of 9.3, published 28 October 2026.
- Which products and versions are affected?
- Aman FunnelKit Automations through 3.8.5.2.
- Is there a fix for CVE-2026-111411?
- Yes: fixed in 3.8.6. Until then: Update the plugin immediately to version 3.8.6 or later. If unable to update, ask your hosting provider or web developer to apply the patch, or use Patchstack's mitigation rule to block attack attempts until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-111411 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-111411?
- Check whether you run Aman FunnelKit Automations at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.8.6
Update the plugin immediately to version 3.8.6 or later. If unable to update, ask your hosting provider or web developer to apply the patch, or use Patchstack's mitigation rule to block attack attempts until patching is possible.
Technical details
The plugin contains improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. An unauthenticated attacker can craft malicious input to manipulate database queries and extract or modify sensitive information. A fix is available in version 3.8.6.
Affected products
- Aman FunnelKit Automations through 3.8.5.2
Timeline
- 2026-10-26: disclosed
- 2026-10-28: advisory