Vulnerabilities / CartFlows – Funnel Builder & Checkout Plugin for WooCommerce / WPSEC-2026-2255
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Payment Bypass via Optin Form Checkout
Medium 5.3
CWE-840Fixed in 3.3.1
- ID
- WPSEC-2026-2255
- Plugin
- CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (cartflows)
- Affected
- all versions before 3.3.1
- Remediation
- Update to 3.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- CartFlows – Funnel Builder & Checkout Plugin for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The CartFlows plugin for WordPress is vulnerable to a payment bypass via the optin form checkout in all versions up to, and including, 3.3.0. On optin steps the plugin marks the cart as not needing payment and disables all payment gateways. It does this without checking that the cart submitted to the checkout AJAX endpoint contains only the free optin product, because the optin cart is only rebuilt on page load. It also accepted any posted '_wcf_optin_id' value as an optin checkout. This makes it possible for unauthenticated attackers to place orders for paid products without paying.
References
- https://wpsec.com/vuln/WPSEC-2026-2255/
- https://plugins.svn.wordpress.org/cartflows/tags/3.3.1/
- https://wordpress.org/plugins/cartflows/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS