SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 2.8.0 - Unauthenticated Insecure Direct Object Reference to Order Payment Link Disclosure via 'order' Parameter
- ID
- WPSEC-2026-2034
- Plugin
- SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster (sellkit)
- Affected
- all versions before 2.8.1
- Remediation
- Update to 2.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster on WPSec AttackSurface
- Fix released
- Published
Description
The SellKit plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order' query parameter of the Order Details Elementor widget in all versions up to, and including, 2.8.0. This is due to the widget loading the WooCommerce order named by a user-supplied numeric ID without checking the order key. For failed orders it then prints the order's payment link, which contains the secret order key. This makes it possible for unauthenticated attackers to enumerate order IDs on a page that contains the widget and obtain the order keys of failed orders. They can then use those keys to view the order details, including the customer's personal and address information.
References
- https://wpsec.com/vuln/WPSEC-2026-2034/
- https://plugins.svn.wordpress.org/sellkit/tags/2.8.1/
- https://wordpress.org/plugins/sellkit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS