CVE-2026-107746
HighCVSS 7.5Summary
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.
Risk Assessment
An attacker can enumerate and retrieve customer PII from all orders, resulting in a privacy breach and potential fraud. The vulnerability is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
Recommendation
Update the FunnelKit plugin to a version newer than 3.16.0.6 as soon as it becomes available. Until then, consider removing the [wfty_order_meta] and [wfty_order_total] shortcodes from thank-you pages or restricting access to them.
Other vulnerabilities in FunnelKit
See all- CVE-2026-12979Medium
The FunnelKit WordPress plugin before version 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, potentially disabling other FunnelKit plugin functions (denial of service).
- CVE-2026-12978High
The FunnelKit WordPress plugin before version 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.
Original NVD description (English source)
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS