{
 "id": "WPSEC-2026-2255",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2255/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2255/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2255/index.md",
 "title": "CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Payment Bypass via Optin Form Checkout",
 "description": "The CartFlows plugin for WordPress is vulnerable to a payment bypass via the optin form checkout in all versions up to, and including, 3.3.0. On optin steps the plugin marks the cart as not needing payment and disables all payment gateways. It does this without checking that the cart submitted to the checkout AJAX endpoint contains only the free optin product, because the optin cart is only rebuilt on page load. It also accepted any posted '_wcf_optin_id' value as an optin checkout. This makes it possible for unauthenticated attackers to place orders for paid products without paying.",
 "plugin": {
  "slug": "cartflows",
  "name": "CartFlows – Funnel Builder & Checkout Plugin for WooCommerce",
  "full_name": "CartFlows – Funnel Builder & Checkout Plugin for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/cartflows/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cartflows/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cartflows"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.1",
 "remediation": "Update to 3.3.1 or later.",
 "fix_released": "2026-11-02T10:34:13+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:21:47.734436+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2255/",
  "https://plugins.svn.wordpress.org/cartflows/tags/3.3.1/",
  "https://wordpress.org/plugins/cartflows/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cartflows",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}