{
 "id": "WPSEC-2026-1904",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1904/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1904/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1904/index.md",
 "title": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Unauthenticated Insecure Direct Object Reference to Offer Charges Against Other Customers' Orders",
 "description": "The WPFunnels plugin for WordPress is vulnerable to Insecure Direct Object Reference via the upsell/downsell offer payment AJAX handlers (Stripe, WooPayments, WooCommerce PayPal Payments and Mollie) in all versions up to, and including, 3.13.5, due to the handlers loading the order from a user-supplied order ID and charging its saved payment method without verifying the order key. The nonces they require are printed on every offer page, and the offer page also accepted any order ID from the URL without an ownership check, which revealed that order's payment gateway. This makes it possible for unauthenticated attackers to trigger offer charges against the saved payment methods of other customers' orders.",
 "plugin": {
  "slug": "wpfunnels",
  "name": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell",
  "full_name": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell",
  "wordpress_org": "https://wordpress.org/plugins/wpfunnels/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpfunnels/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpfunnels"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.13.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.13.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.13.6",
 "remediation": "Update to 3.13.6 or later.",
 "fix_released": "2026-10-28T06:05:57+00:00",
 "published": "2026-10-29T06:44:57+00:00",
 "updated": "2026-10-28T09:20:08.739060+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1904/",
  "https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/",
  "https://wordpress.org/plugins/wpfunnels/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpfunnels",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}