CVE-2026-81649 Details
Description
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
A vulnerability exists in the Fundiin cho WooCommerce WordPress plugin, affecting versions through 3.4.0. The issue arises from improper authorization on several REST API routes, allowing unauthenticated attackers to access payment credentials and customer order data. Exploitation of this vulnerability could lead to unauthorized changes in payment gateway configurations, causing payments to be misdirected, and falsely marking unpaid orders as paid. Additionally, the lack of proper authorization enables the injection of arbitrary scripts into a field that is rendered unescaped on the classic checkout page, resulting in unauthenticated stored cross-site scripting (XSS) on stores that do not utilize the block-based checkout.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/28cec871-1f17-48c7-b836-db705fc5cffa/ | [email protected] | AdvisoryExploitPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Fundiin | <= 3.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |