Live › vulnerability › CVE-2026-107746
Go to dashboardThe FunnelKit Funnel Builder plugin for WordPress fails to check authorization, so anyone can fetch billing details for WooCommerce orders by iterating sequential order IDs. Exposed data includes full name, street address, email address and phone number.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FunnelKit Funnel Builder at version 3.16.0.6 or earlier with WooCommerce are exposed, but only if a FunnelKit thank-you page renders the wfty_order_meta or wfty_order_total shortcode. Stores that run the plugin without those shortcodes on any thank-you page are not exposed according to the description.
No product ranges from the sources yet.
wp plugin get funnel-builder --field=version if WP-CLI is available.[wfty_order_meta] or [wfty_order_total]; the exposure only applies where one renders.3.16.0.6; the sources do not name the fixed release.[wfty_order_meta] and [wfty_order_total] shortcodes from thank-you pages.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
This page as .md · .json · in your agent: get_signal("CVE-2026-107746")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.