Read the docs
TI-2022-02205 Aliases CVE-2022-2389GHSA-7wc7-7jf5-q238

Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation

Priority LOW 20CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations

Why it matters now

EPSS 0.00364 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami (Unknown): 2.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAbandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami2.1.2 to before 2.1.22.1.2Patch availableCNA
  • Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami VendorUnknown Affected 2.1.2 to before 2.1.2 Fixed in 2.1.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*before 2.1.2VulnerableFunnelKit
  • cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:* Versions before 2.1.2 Vulnerable ·FunnelKit

Remediation

  • Fix · CNA Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami (Unknown) Fixed in 2.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2389
  2. 2026-10-03 Alias added: GHSA-7wc7-7jf5-q238

References

Exploit 1

  • TI-2024-08524 Automation By Autonami < 3.3.0 - Unauthenticated SQLi CVSS 3.1HIGH 8.6
  • TI-2025-01346 Missing authorization in FunnelKit Automations – Email Marketing Automation and CRM for… CVSS 3.1CRITICAL 9.8
  • TI-2024-31646 SQL injection in Aman FunnelKit Automations CVSS 3.1HIGH 7.6
  • TI-2023-27762 WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2025-11440 Information disclosure in FunnelKit Automations – Email Marketing Automation and CRM for… CVSS 3.1MEDIUM 5.3
  • TI-2025-11441 Missing authorization in FunnelKit Automations – Email Marketing Automation and CRM for… CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences