# Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.6 - Authenticated (Subscriber+) Missing Authorization to Offer Page Creation and Arbitrary Post Content Overwrite

- **ID:** WPSEC-2026-2281
- **Plugin:** Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. (`upsell-order-bump-offer-for-woocommerce`), https://wordpress.org/plugins/upsell-order-bump-offer-for-woocommerce/
- **Affected versions:** all versions before 3.1.7
- **Fixed in:** 3.1.7 (Update to 3.1.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/upsell-order-bump-offer-for-woocommerce
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2281/

## Description

The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the 'wps_upsell_activate_offer_template_ajax' and 'wps_wocuf_pro_return_offer_content' AJAX actions in all versions up to, and including, 3.1.6. This is due to missing capability checks on the activate_respective_offer_template() and return_funnel_offer_section_content() functions, no validation of the supplied 'offer_post_id', and the required 'wps_wocuf_nonce' nonce being printed on the front end to any visitor who adds the 'ocuf_ns' parameter to a URL. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create published 'Special Offer' pages and to overwrite the content of arbitrary posts and pages with the plugin's offer template when Elementor or Divi is active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2281/
- https://plugins.svn.wordpress.org/upsell-order-bump-offer-for-woocommerce/tags/3.1.7/
- https://wordpress.org/plugins/upsell-order-bump-offer-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2281/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.