CVE-2026-107746 Details
Description
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
A vulnerability exists in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress, in all versions through 3.16.0.6. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables unauthenticated attackers to access personal billing information, including full names, addresses, email addresses, and phone numbers, for any WooCommerce order on the site. The exploitation involves submitting a sequential order ID. This vulnerability is only applicable on sites with a FunnelKit thank-you page that displays the [wfty_order_meta] or [wfty_order_total] shortcode.
Users are advised to update the FunnelKit – Funnel Builder for WooCommerce Checkout plugin to version 3.17.0 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FunnelKit | <= 3.16.0.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |