CVE-2026-107746

7.5High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Unauthenticated attackers can harvest full customer billing PII (names, street addresses, emails, and phone numbers) remotely. They only need network access to enumerate sequential WooCommerce order IDs on exposed FunnelKit thank-you pages.

Root cause

The plugin's thank-you page module processes order data requests without checking if the requesting user is authorized to view the specified order ID.

Affected systems

FunnelKit – Funnel Builder for WooCommerce Checkout plugin up to, and including, 3.16.0.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to version 3.17.0 or later. If you cannot patch immediately, edit or unpublish any FunnelKit thank-you pages that use the [wfty_order_meta] or [wfty_order_total] shortcodes.

shell

$ wp plugin update funnel-builder --version=3.17.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-107746