FunnelKit vulnerabilities

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress (versions up to and including 3.16.0.6) is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can retrieve billing PII (full name, street address, email address, phone number) for any WooCommerce order by submitting an enumerable sequential order ID.

The FunnelKit WordPress plugin before version 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, potentially disabling other FunnelKit plugin functions (denial of service).

The FunnelKit WordPress plugin before version 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.