CVE-2026-107746: FunnelKit WooCommerce Authorization Bypass

CVE-2026-107746 is an authorization bypass flaw in FunnelKit Funnel Builder for WooCommerce that allows unauthenticated attackers to access customer billing data including names, addresses, and contact information. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-107746 Overview

CVE-2026-107746 is an authorization bypass vulnerability in the FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress. The flaw affects all versions up to and including 3.16.0.6. The plugin fails to verify that a requesting user is authorized to view WooCommerce order data rendered by its thank-you page shortcodes. Unauthenticated attackers can enumerate sequential order IDs to retrieve billing personally identifiable information (PII), including full name, street address, email address, and phone number. Exploitation requires that a FunnelKit thank-you page exists on the site and renders the [wfty_order_meta] or [wfty_order_total] shortcode.

Critical Impact
Unauthenticated attackers can harvest customer PII from every WooCommerce order on a vulnerable store by iterating order IDs.

Affected Products

FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress, versions up to and including 3.16.0.6
WordPress sites running WooCommerce with a FunnelKit thank-you page configured
Thank-you pages rendering the [wfty_order_meta] or [wfty_order_total] shortcode

Discovery Timeline

2026-10-16 - CVE-2026-107746 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107746

Vulnerability Analysis

The vulnerability is a missing authorization flaw classified as [CWE-862]. The FunnelKit thank-you page module renders order metadata through two shortcodes, [wfty_order_meta] and [wfty_order_total]. When a visitor loads a thank-you page and supplies an order identifier, the plugin loads the referenced WooCommerce order and renders its billing data without verifying that the requester owns the order or holds a valid order key. Because WooCommerce order IDs are sequential integers, an attacker can script enumeration across the full order range to extract PII for every historical order on the site.

Root Cause

The root cause is the absence of a capability or ownership check inside the thank-you page data pipeline. The relevant handlers in modules/thankyou-pages/class-wffn-thank-you-wc-pages.php and modules/thankyou-pages/includes/class-wfty-data.php accept an order ID from request context and retrieve the order object without validating the order key, user session, or current_user_can capability. The shortcode output then exposes billing fields that WooCommerce treats as privileged customer data.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. The attacker needs a FunnelKit thank-you page URL on the target site that embeds either affected shortcode. The attacker then issues HTTP GET requests substituting incrementing values for the order identifier parameter and parses billing fields from the HTML response. No credentials, cookies, or elevated privileges are required.

No verified exploit code is published. See the Wordfence Vulnerability Report and the affected source lines in class-wfty-data.php for technical references.

Detection Methods for CVE-2026-107746

Indicators of Compromise

Sequential or rapid HTTP GET requests to FunnelKit thank-you page URLs with incrementing order ID parameters from a single source IP.
Unusually high request volumes targeting pages containing [wfty_order_meta] or [wfty_order_total] shortcodes.
Access log entries showing non-customer user agents (scrapers, headless browsers, curl) retrieving thank-you pages.

Detection Strategies

Review web server access logs for order ID enumeration patterns against the configured FunnelKit thank-you page path.
Hunt for requests referencing thank-you pages that originate from IPs that never completed a WooCommerce checkout.
Correlate thank-you page requests against the WooCommerce order table to identify requests referencing orders not owned by the requesting session.

Monitoring Recommendations

Enable rate limiting and bot detection on URLs mapped to FunnelKit thank-you pages.
Alert when a single client requests more than a defined threshold of distinct order IDs within a short time window.
Forward WordPress and web server logs to a centralized SIEM or data lake for retention and query against enumeration patterns.

How to Mitigate CVE-2026-107746

Immediate Actions Required

Upgrade the FunnelKit – Funnel Builder for WooCommerce Checkout plugin to version 3.17.0 or later.
Audit all configured thank-you pages and remove or restrict [wfty_order_meta] and [wfty_order_total] shortcodes until the patch is applied.
Review web server logs for prior enumeration activity and notify affected customers if PII disclosure is confirmed.

Patch Information

The vendor addressed the authorization bypass in FunnelKit Funnel Builder version 3.17.0. The patched release is available from the WordPress plugin repository. Administrators should update through the WordPress dashboard or by replacing the plugin files with the fixed release.

Workarounds

Temporarily unpublish or password-protect any FunnelKit thank-you pages that embed the affected shortcodes.
Place a web application firewall rule in front of thank-you page URLs to block requests lacking a valid WooCommerce order key parameter.
Restrict access to thank-you page URLs by referrer or short-lived signed tokens until the plugin is upgraded.

bash

# Example WP-CLI command to update the plugin to the patched release
wp plugin update funnel-builder --version=3.17.0