# CVE-2026-111411: Aman FunnelKit Automations SQL injection

Source: https://junglewise.ai/threats/cve-2026-111411-improper-neutralization-of-special-elements-used-in-an-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-111411 · Severity: critical · CVSS 9.3 · Published 2026-10-28

FunnelKit Automations is a WordPress plugin that handles marketing automation and email campaigns. A SQL injection vulnerability allows unauthenticated attackers to read, modify, or delete entire databases including user accounts and sensitive customer data. This vulnerability is critical and could expose business data and customer information to unauthorized access.

Vendors: [Aman](https://junglewise.ai/threats/vendors/aman).

## Quick answers

**Is CVE-2026-111411 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111411 being exploited in the wild.

**How severe is CVE-2026-111411?** Critical severity, with a CVSS score of 9.3, published 28 October 2026.

**Which products and versions are affected?** Aman FunnelKit Automations through 3.8.5.2.

**Is there a fix for CVE-2026-111411?** Yes: fixed in 3.8.6. Until then: Update the plugin immediately to version 3.8.6 or later. If unable to update, ask your hosting provider or web developer to apply the patch, or use Patchstack's mitigation rule to block attack attempts until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111411 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111411?** Check whether you run Aman FunnelKit Automations at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.6

Update the plugin immediately to version 3.8.6 or later. If unable to update, ask your hosting provider or web developer to apply the patch, or use Patchstack's mitigation rule to block attack attempts until patching is possible.

## Technical details

The plugin contains improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. An unauthenticated attacker can craft malicious input to manipulate database queries and extract or modify sensitive information. A fix is available in version 3.8.6.

## Affected products

- Aman FunnelKit Automations through 3.8.5.2

## Timeline

- 2026-10-26: disclosed
- 2026-10-28: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-5-2-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-5-2-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Aman FunnelKit Automations cross-site request forgery](https://junglewise.ai/threats/cve-2026-111841-cross-site-request-forgery-csrf-vulnerability-in-aman-funnelkit)