# WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Unauthenticated Insecure Direct Object Reference to Offer Charges Against Other Customers' Orders

- **ID:** WPSEC-2026-1904
- **Plugin:** WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (`wpfunnels`), https://wordpress.org/plugins/wpfunnels/
- **Affected versions:** all versions before 3.13.6
- **Fixed in:** 3.13.6 (Update to 3.13.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpfunnels
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1904/

## Description

The WPFunnels plugin for WordPress is vulnerable to Insecure Direct Object Reference via the upsell/downsell offer payment AJAX handlers (Stripe, WooPayments, WooCommerce PayPal Payments and Mollie) in all versions up to, and including, 3.13.5, due to the handlers loading the order from a user-supplied order ID and charging its saved payment method without verifying the order key. The nonces they require are printed on every offer page, and the offer page also accepted any order ID from the URL without an ownership check, which revealed that order's payment gateway. This makes it possible for unauthenticated attackers to trigger offer charges against the saved payment methods of other customers' orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-1904/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/
- https://wordpress.org/plugins/wpfunnels/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1904/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.