CVE-2025-3743 Overview
CVE-2025-3743 affects the Upsell Funnel Builder for WooCommerce plugin for WordPress in all versions up to and including 3.0.0. The vulnerability allows unauthenticated attackers to manipulate the additional product ID and discount fields processed by the add_offer_in_cart function. Attackers can arbitrarily change the product associated with any order bump and modify the discount applied when items are added to the cart. The flaw stems from missing validation of client-supplied parameters before they influence server-side order processing, classified under [CWE-472] External Control of Assumed-Immutable Web Parameter.
Critical Impact
Unauthenticated attackers can swap order bump products and apply arbitrary discounts, causing revenue loss and inventory integrity issues on affected WooCommerce stores.
Affected Products
- Upsell Funnel Builder for WooCommerce (plugin slug: upsell-order-bump-offer-for-woocommerce)
- All versions up to and including 3.0.0
- WordPress sites running WooCommerce with this plugin enabled
Discovery Timeline
- 2025-04-25 - CVE-2025-3743 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3743
Vulnerability Analysis
The vulnerability resides in the add_offer_in_cart function within class-upsell-order-bump-offer-for-woocommerce-public.php. When a customer accepts an order bump offer, the plugin accepts the target product ID and discount value directly from client-supplied request parameters. The server treats these values as trusted and forwards them into the cart processing logic without cross-referencing the legitimate offer configuration stored server-side.
Because the endpoint is reachable by unauthenticated visitors during the checkout flow, any attacker can send crafted requests to substitute high-value products in place of the intended upsell item. Attackers can also inject arbitrary discount values, potentially reducing the price to near zero. The result is a business logic flaw with direct financial impact on the store operator.
Root Cause
The root cause is external control of assumed-immutable web parameters. The plugin assumes the product ID and discount transmitted from the browser reflect the merchant-defined offer, but never validates these values against the stored order bump configuration on the server side.
Attack Vector
The attack is executed over the network with no authentication and no user interaction beyond the attacker's own checkout session. An adversary intercepts or crafts the add-to-cart request associated with the order bump and modifies the product ID or discount parameters before submission. The manipulated request is processed and added to the cart at the attacker-controlled price. See the Wordfence Vulnerability Analysis and the affected code paths in the WordPress Code Review Line 1771 and Line 1818 for the vulnerable request handling.
Detection Methods for CVE-2025-3743
Indicators of Compromise
- Completed WooCommerce orders containing order bump line items with prices that do not match the merchant-configured offer.
- Cart or order records showing product IDs on the order bump that were never associated with a configured funnel.
- Unusually high discount percentages applied only to order bump line items across multiple orders.
Detection Strategies
- Review WooCommerce order records for order bump items whose sale price deviates from the configured upsell price.
- Compare submitted product_id and discount parameters in web server logs against the offers defined in the plugin database tables.
- Correlate anomalous checkout requests to admin-ajax.php or the plugin's cart handler with the resulting order line items.
Monitoring Recommendations
- Enable verbose logging on WooCommerce cart and order events, including original request payloads for order bump acceptance.
- Alert on repeated add-to-cart requests from the same IP referencing product IDs outside the configured offer catalog.
- Track discount totals per SKU over time to identify statistical outliers indicative of parameter tampering.
How to Mitigate CVE-2025-3743
Immediate Actions Required
- Upgrade the Upsell Funnel Builder for WooCommerce plugin to a version later than 3.0.0 that includes the fix from WordPress Changeset 3279944.
- Audit recent orders processed while version 3.0.0 or earlier was active to identify potentially manipulated transactions.
- Deactivate the plugin on stores where an upgrade cannot be immediately applied.
Patch Information
The vendor addressed the vulnerability in the commit tracked as WordPress Changeset 3279944. The fix enforces server-side validation of the order bump product ID and discount against the stored offer configuration rather than trusting client-supplied values. Site administrators should update through the WordPress plugin manager and confirm the running version is above 3.0.0.
Workarounds
- Disable the Upsell Funnel Builder for WooCommerce plugin until the patched version is installed.
- Deploy a web application firewall rule to reject cart requests where the product_id parameter does not match a whitelisted set of configured order bump SKUs.
- Implement manual order review for any transaction that includes an order bump line item until the patch is verified in production.
# Update the affected plugin via WP-CLI
wp plugin update upsell-order-bump-offer-for-woocommerce
wp plugin get upsell-order-bump-offer-for-woocommerce --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
