---
id: "CVE-2026-107746"
kind: "vulnerability"
aliases: ["CVE-2026-107746"]
title: "FunnelKit WooCommerce checkout plugin: unauthenticated access to customer billing data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "funnelkit", "package", "woocommerce", "wordpress"]
not_affected_if: ["no-thank-you-page-shortcode", "patched-version", "plugin-not-installed"]
published_at: "2026-10-16T05:17:28+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:25:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107746", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# FunnelKit WooCommerce checkout plugin: unauthenticated access to customer billing data

The FunnelKit Funnel Builder plugin for WordPress fails to check authorization, so anyone can fetch billing details for WooCommerce orders by iterating sequential order IDs. Exposed data includes full name, street address, email address and phone number.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FunnelKit (Funnel Builder for WooCommerce Checkout) plugin version in the WordPress admin plugins list, or with `wp plugin get funnel-builder --field=version` if WP-CLI is available.
- Search thank-you page content and templates for the shortcodes `[wfty_order_meta]` or `[wfty_order_total]`; the exposure only applies where one renders.

## Fix

- Update the FunnelKit Funnel Builder plugin to a version newer than `3.16.0.6`; the sources do not name the fixed release.
- If no patched version is available yet, remove the `[wfty_order_meta]` and `[wfty_order_total]` shortcodes from thank-you pages.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107746

## From the sources

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_