CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Shortcode Execution via Checkout, Optin and Thank You Page Output
- ID
- WPSEC-2026-2256
- Plugin
- CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (cartflows)
- Affected
- all versions before 3.3.1
- Remediation
- Update to 3.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- CartFlows – Funnel Builder & Checkout Plugin for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The CartFlows plugin for WordPress is vulnerable to arbitrary shortcode execution via the checkout, optin and thank you page output in all versions up to, and including, 3.3.0. The plugin puts customer-controlled data into the markup of its checkout, optin and order details shortcodes without neutralizing shortcode brackets. That data includes checkout field values pre-filled from URL query parameters (any parameter name was accepted), WooCommerce notices such as an unknown coupon code, and order details. When these shortcodes are rendered through the plugin's blocks or page builder widgets, their output is processed for shortcodes a second time. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-2256/
- https://plugins.svn.wordpress.org/cartflows/tags/3.3.1/
- https://wordpress.org/plugins/cartflows/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS