{"id":"CVE-2026-107746","kind":"vulnerability","aliases":["CVE-2026-107746"],"related":[],"title":"FunnelKit WooCommerce checkout plugin: unauthenticated access to customer billing data","description":"The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.","summary":"The FunnelKit Funnel Builder plugin for WordPress fails to check authorization, so anyone can fetch billing details for WooCommerce orders by iterating sequential order IDs. Exposed data includes full name, street address, email address and phone number.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","funnelkit","package","woocommerce","wordpress"],"not_affected_if":["no-thank-you-page-shortcode","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed FunnelKit (Funnel Builder for WooCommerce Checkout) plugin version in the WordPress admin plugins list, or with `wp plugin get funnel-builder --field=version` if WP-CLI is available.\n- Search thank-you page content and templates for the shortcodes `[wfty_order_meta]` or `[wfty_order_total]`; the exposure only applies where one renders.","fix":"- Update the FunnelKit Funnel Builder plugin to a version newer than `3.16.0.6`; the sources do not name the fixed release.\n- If no patched version is available yet, remove the `[wfty_order_meta]` and `[wfty_order_total]` shortcodes from thank-you pages.","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:15+00:00","updated_at":"2026-10-25T03:25:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:25:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the FunnelKit Funnel Builder plugin to a version newer than `3.16.0.6`; the sources do not name the fixed release.\n- If no patched version is available yet, remove the `[wfty_order_meta]` and `[wfty_order_total]` shortcodes from thank-you pages.","reach":"internet","title":"FunnelKit WooCommerce checkout plugin: unauthenticated access to customer billing data","impact":"medium","summary":"The FunnelKit Funnel Builder plugin for WordPress fails to check authorization, so anyone can fetch billing details for WooCommerce orders by iterating sequential order IDs. Exposed data includes full name, street address, email address and phone number.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","funnelkit","ecommerce"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attackers read customer names, addresses, emails and phone numbers","analyst_note":"Confirm the first fixed FunnelKit version beyond 3.16.0.6 from the plugin changelog or the NVD/Wordfence entry for CVE-2026-107746.","how_to_check":"- Check the installed FunnelKit (Funnel Builder for WooCommerce Checkout) plugin version in the WordPress admin plugins list, or with `wp plugin get funnel-builder --field=version` if WP-CLI is available.\n- Search thank-you page content and templates for the shortcodes `[wfty_order_meta]` or `[wfty_order_total]`; the exposure only applies where one renders.","needs_analyst":true,"not_affected_if":["no-thank-you-page-shortcode","patched-version","plugin-not-installed"],"who_is_affected":"Sites running FunnelKit Funnel Builder at version 3.16.0.6 or earlier with WooCommerce are exposed, but only if a FunnelKit thank-you page renders the wfty_order_meta or wfty_order_total shortcode. Stores that run the plugin without those shortcodes on any thank-you page are not exposed according to the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":3443,"output_tokens":762,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107746':13A,16A '-2026':12A,15A '3.16.0.6':81C 'access':6A 'action':99C 'address':53B,55B,115C,117C 'anyon':34B 'attack':106C 'author':32B,72C,95C 'bill':9A,37B,109C 'builder':25B,62C 'bypass':73C 'check':31B 'checkout':3A,65C 'custom':8A 'cve':11A,14A 'data':10A,48B 'detail':38B 'due':84C 'ecommerc':17B 'email':54B,116C 'enumer':131C 'exist':148C 'exploit':138C 'expos':47B 'fail':29B 'fetch':36B 'full':50B,112C 'funnel':24B,61C 'funnelkit':1A,18B,23B,60C,143C 'id':46B,134C 'includ':49B,80C,111C 'iter':43B 'make':101C 'meta':154C 'name':51B,113C 'number':58B,120C 'order':41B,45B,124C,133C,153C,157C 'packag':19B 'page':147C 'perform':97C 'phone':57B,119C 'pii':110C 'plugin':4A,26B,66C,87C 'possibl':103C 'proper':89C 'render':150C 'retriev':108C 'sequenti':44B,132C 'shortcod':159C 'site':127C,140C 'street':52B,114C 'submit':129C 'thank':145C 'thank-you':144C 'total':158C 'unauthent':5A,105C 'user':93C 'verifi':90C 'version':76C 'vulner':70C 'wfti':152C,156C 'woocommerc':2A,20B,40B,64C,123C 'wordpress':21B,28B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running FunnelKit Funnel Builder at version 3.16.0.6 or earlier with WooCommerce are exposed, but only if a FunnelKit thank-you page renders the wfty_order_meta or wfty_order_total shortcode. Stores that run the plugin without those shortcodes on any thank-you page are not exposed according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107746","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T16:16:57+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}