CVE-2026-84908: WPFunnels WordPress Plugin Auth Bypass

CVE-2026-84908 Overview

The WPFunnels plugin for WordPress contains a Missing Authorization vulnerability [CWE-862] affecting all versions up to and including 3.12.13. The flaw exists in the wpfnl_load_payment AJAX action, which the plugin registers for both authenticated and unauthenticated users via wp_ajax_nopriv_. The underlying add_offer_product_to_cart() function performs no nonce verification, no capability check, and no validation that the attacker-supplied product_id matches the offer product configured on the supplied step_id. Unauthenticated attackers can add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step.

Critical Impact
Unauthenticated attackers can manipulate WooCommerce cart pricing, purchasing arbitrary products at discounted funnel-step prices and causing direct revenue loss at checkout.

Affected Products

WPFunnels plugin for WordPress, all versions through 3.12.13
WooCommerce storefronts using WPFunnels for sales funnels and offer steps
Any WordPress site with the vulnerable wpfnl_load_payment AJAX handler exposed

Discovery Timeline

2026-09-09 - CVE-2026-84908 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-84908

Vulnerability Analysis

The vulnerability resides in the WPFunnels offer handler defined in includes/core/offer/class-wpfnl-offer.php. The plugin registers the wpfnl_load_payment AJAX action against both wp_ajax_ and wp_ajax_nopriv_ hooks, exposing the endpoint to anonymous requests. The handler dispatches into add_offer_product_to_cart(), which reads the client-supplied product_id, step_id, and pricing parameters directly from the request body without verification.

The function omits three essential authorization controls. It does not call check_ajax_referer() or verify a WordPress nonce. It does not perform a capability check via current_user_can(). It does not validate that the submitted product_id corresponds to the offer product actually configured on the specified step_id. As a result, an attacker can request that any WooCommerce product be added to the cart at any discount price configured anywhere in any funnel.

Root Cause

The root cause is a classic Missing Authorization pattern [CWE-862] combined with missing input-to-configuration cross-validation. The offer class trusts client-supplied identifiers as authoritative and bypasses the funnel builder's intended pricing logic.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted POST request to admin-ajax.php with action=wpfnl_load_payment, an arbitrary product_id for a high-value WooCommerce item, and a step_id that references a funnel step with a steep discount. The cart is populated at the discounted price, and the attacker proceeds through checkout normally. Technical details are available in the Wordfence Vulnerability Report and the WPFunnels Offer Class source.

Detection Methods for CVE-2026-84908

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wpfnl_load_payment from unauthenticated sessions or unusual client fingerprints
WooCommerce orders where the line-item price is significantly below the product's configured regular price
Cart additions where the product_id does not match any product legitimately mapped to the referenced funnel step_id
Order bursts from the same IP range or user-agent immediately following requests to wpfnl_load_payment

Detection Strategies

Enable verbose access logging on admin-ajax.php and alert on wpfnl_load_payment invocations without a valid authenticated session cookie
Reconcile completed WooCommerce orders against catalog pricing and flag any deviation greater than expected funnel discounts
Correlate anonymous AJAX activity with subsequent order creation events in the WooCommerce database

Monitoring Recommendations

Ingest WordPress and WooCommerce logs into a centralized analytics pipeline for cross-referencing anonymous AJAX calls with order records
Monitor for rapid, repeated wpfnl_load_payment calls from single source IPs indicating automated abuse
Track daily average order value and alert on statistically significant drops that may indicate ongoing price manipulation

How to Mitigate CVE-2026-84908

Immediate Actions Required

Update the WPFunnels plugin to a version later than 3.12.13 as soon as a fixed release is available from the vendor
Audit recent WooCommerce orders for line-item prices that fall below the configured product regular price
Temporarily deactivate WPFunnels on production stores if patching cannot be completed promptly

Patch Information

Refer to the WPFunnels changeset and the vulnerable source file references at line 71, line 166, and line 213. A fix must remove the wp_ajax_nopriv_wpfnl_load_payment registration, enforce nonce verification with check_ajax_referer(), and validate that the submitted product_id matches the configured offer product on the referenced step_id.

Workarounds

Block or rate-limit unauthenticated POST requests to admin-ajax.php with action=wpfnl_load_payment at the web application firewall
Restrict funnel-step discount configurations to modest reductions until the plugin is patched, limiting the financial impact of a successful exploit
Require manual review for WooCommerce orders whose totals fall below defined price thresholds before fulfillment

bash

# Example WAF rule (ModSecurity-style) to block anonymous wpfnl_load_payment calls
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1008490801,\
   msg:'Block unauthenticated WPFunnels wpfnl_load_payment (CVE-2026-84908)'"
  SecRule ARGS:action "@streq wpfnl_load_payment" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"