# CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Payment Bypass via Optin Form Checkout

- **ID:** WPSEC-2026-2255
- **Plugin:** CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (`cartflows`), https://wordpress.org/plugins/cartflows/
- **Affected versions:** all versions before 3.3.1
- **Fixed in:** 3.3.1 (Update to 3.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cartflows
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2255/

## Description

The CartFlows plugin for WordPress is vulnerable to a payment bypass via the optin form checkout in all versions up to, and including, 3.3.0. On optin steps the plugin marks the cart as not needing payment and disables all payment gateways. It does this without checking that the cart submitted to the checkout AJAX endpoint contains only the free optin product, because the optin cart is only rebuilt on page load. It also accepted any posted '_wcf_optin_id' value as an optin checkout. This makes it possible for unauthenticated attackers to place orders for paid products without paying.

## References

- https://wpsec.com/vuln/WPSEC-2026-2255/
- https://plugins.svn.wordpress.org/cartflows/tags/3.3.1/
- https://wordpress.org/plugins/cartflows/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2255/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.