CVE-2026-107746

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip
https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429
https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286
https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318
https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328
https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve

Configurations

No configuration.

History

16 Oct 2026, 05:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 05:17

Updated : 2026-10-16 16:16

NVD link : CVE-2026-107746

Mitre link : CVE-2026-107746

CVE.ORG link : CVE-2026-107746

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-107746", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107746", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:31.146847Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "teamfunnelkit", "product": "FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.16.0.6"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-16T05:17:28.837", "references": [{"url": "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII \u2014 including full name, street address, email address, and phone number \u2014 for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode."}], "lastModified": "2026-10-16T16:16:57.983", "sourceIdentifier": "security@wordfence.com"}