WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Unauthenticated Insecure Direct Object Reference to Offer Charges Against Other Customers' Orders
- ID
- WPSEC-2026-1904
- Plugin
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (wpfunnels)
- Affected
- all versions before 3.13.6
- Remediation
- Update to 3.13.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell on WPSec AttackSurface
- Fix released
- Published
Description
The WPFunnels plugin for WordPress is vulnerable to Insecure Direct Object Reference via the upsell/downsell offer payment AJAX handlers (Stripe, WooPayments, WooCommerce PayPal Payments and Mollie) in all versions up to, and including, 3.13.5, due to the handlers loading the order from a user-supplied order ID and charging its saved payment method without verifying the order key. The nonces they require are printed on every offer page, and the offer page also accepted any order ID from the URL without an ownership check, which revealed that order's payment gateway. This makes it possible for unauthenticated attackers to trigger offer charges against the saved payment methods of other customers' orders.
References
- https://wpsec.com/vuln/WPSEC-2026-1904/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/
- https://wordpress.org/plugins/wpfunnels/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS