CVE-2026-109991 Details
Description
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress, affecting all versions through 1.15.0.2. The vulnerability arises from missing validation on a user-controlled key in the 'order-pay' parameter, which is part of the WordPress query variable for the order payment checkout process. This flaw enables unauthenticated attackers to access sensitive billing information, including names, email addresses, phone numbers, and full street addresses, of any store order. The exploitation can be done by sequentially enumerating order IDs, as the personal information is injected into the inline 'fkwcs_data' JavaScript object via 'wp_localize_script' on every corresponding page response. Notably, this vulnerability can be exploited even when WooCommerce itself denies the order-pay page request, because the plugin's 'wp_localize_script' function operates independently of WooCommerce's order-key validation.
Users are advised to update the FunnelKit Payment Gateway for Stripe WooCommerce plugin to version 1.16.0 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FunnelKit Payment Gateway | <= 1.15.0.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2026 | New CVE Received | [email protected] |