CVE-2026-57635 Overview
CVE-2026-57635 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the FunnelKit Payment Gateway for Stripe WooCommerce plugin. The flaw affects all plugin versions up to and including 1.14.0.3. Attackers can craft malicious web pages that trigger state-changing actions in the plugin when an authenticated administrator visits the attacker-controlled content. The vulnerability is tracked under CWE-352 and has been published to the National Vulnerability Database.
Critical Impact
An unauthenticated attacker can abuse an administrator's session to perform unauthorized configuration changes on the WooCommerce Stripe payment gateway, potentially compromising the integrity of payment processing.
Affected Products
- FunnelKit Payment Gateway for Stripe WooCommerce plugin versions <= 1.14.0.3
- WordPress sites running the vulnerable plugin
- WooCommerce storefronts relying on FunnelKit for Stripe payment processing
Discovery Timeline
- 2026-06-26 - CVE-2026-57635 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-57635
Vulnerability Analysis
The vulnerability arises from missing CSRF protections in one or more request handlers within the FunnelKit Payment Gateway for Stripe WooCommerce plugin. Endpoints that modify plugin state do not validate a per-request anti-CSRF token, and they do not verify the origin of the request. An attacker crafts a page containing a forged form or JavaScript that submits to the vulnerable endpoint. When an authenticated administrator loads the attacker-controlled page, the browser automatically attaches the session cookie, and the plugin processes the request as legitimate. The attack requires user interaction from a privileged user, which explains the network attack vector combined with user interaction.
Root Cause
The root cause is the absence of a valid WordPress nonce check (CWE-352) on request handlers that alter plugin configuration. WordPress plugins typically enforce CSRF protection using wp_nonce_field() on the form side and check_admin_referer() or wp_verify_nonce() on the server side. Vulnerable handlers in versions up to 1.14.0.3 omit these checks or apply them incorrectly.
Attack Vector
Exploitation is remote and unauthenticated from the attacker's perspective. The attacker delivers a link, email, or embedded resource that loads a crafted request against the target WordPress site. The victim must be an authenticated administrator with access to the plugin functionality. Successful exploitation impacts integrity of payment gateway settings without directly affecting confidentiality or availability. Additional technical detail is available in the Patchstack Vulnerability Report.
No verified public proof-of-concept code is available. The vulnerability follows a standard WordPress CSRF pattern: a forged POST or GET request targeting a plugin endpoint executes under the victim administrator's session because no nonce or referer validation is enforced.
Detection Methods for CVE-2026-57635
Indicators of Compromise
- Unexpected changes to FunnelKit Stripe payment gateway settings in the WordPress admin dashboard
- Administrator sessions issuing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains
- Access log entries showing plugin configuration endpoints hit without a preceding admin page load
- Modifications to Stripe API keys, webhook URLs, or gateway options with no matching audit trail
Detection Strategies
- Inspect web server access logs for state-changing requests to FunnelKit plugin endpoints that lack expected _wpnonce parameters
- Correlate WordPress user activity logs against changes recorded in wp_options for FunnelKit-related keys
- Alert on cross-origin Referer values on administrative POST requests to /wp-admin/admin.php and /wp-admin/admin-ajax.php
Monitoring Recommendations
- Enable WordPress audit logging to capture all configuration changes made through the plugin
- Monitor outbound traffic from the WooCommerce site to detect Stripe API changes triggered by unauthorized configuration updates
- Track browser-originated requests to admin endpoints and flag those without valid nonce parameters
How to Mitigate CVE-2026-57635
Immediate Actions Required
- Update the FunnelKit Payment Gateway for Stripe WooCommerce plugin to a version newer than 1.14.0.3 as soon as a fixed release is available
- Require administrators to sign out of the WordPress admin dashboard when not actively working
- Review recent changes to Stripe gateway configuration and rotate Stripe API keys if tampering is suspected
Patch Information
Refer to the Patchstack Vulnerability Report for the current patch status and vendor guidance. Site operators should apply the vendor-issued fix through the WordPress plugin update mechanism once released.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist using a web application firewall or web server configuration
- Deploy a WordPress security plugin that enforces referer and nonce checks on administrative POST requests
- Instruct administrators to use dedicated browser profiles for WordPress administration to reduce exposure to attacker-controlled content
- Temporarily disable the FunnelKit Stripe plugin if a patched version is unavailable and payment processing can tolerate the downtime
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
