Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.6 - Authenticated (Subscriber+) Missing Authorization to Offer Page Creation and Arbitrary Post Content Overwrite
- ID
- WPSEC-2026-2281
- Plugin
- Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. (upsell-order-bump-offer-for-woocommerce)
- Affected
- all versions before 3.1.7
- Remediation
- Update to 3.1.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. on WPSec AttackSurface
- Fix released
- Published
Description
The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the 'wps_upsell_activate_offer_template_ajax' and 'wps_wocuf_pro_return_offer_content' AJAX actions in all versions up to, and including, 3.1.6. This is due to missing capability checks on the activate_respective_offer_template() and return_funnel_offer_section_content() functions, no validation of the supplied 'offer_post_id', and the required 'wps_wocuf_nonce' nonce being printed on the front end to any visitor who adds the 'ocuf_ns' parameter to a URL. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create published 'Special Offer' pages and to overwrite the content of arbitrary posts and pages with the plugin's offer template when Elementor or Divi is active.
References
- https://wpsec.com/vuln/WPSEC-2026-2281/
- https://plugins.svn.wordpress.org/upsell-order-bump-offer-for-woocommerce/tags/3.1.7/
- https://wordpress.org/plugins/upsell-order-bump-offer-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS