FUNNELKIT-STRIPE-WOO-PAYMENT-GATEWAY · CVE-2026-109991 · Package
FIX → 1.16.0
The FunnelKit Payment Gateway for Stripe WooCommerce plugin up to and including 1.15.0.2 exposes billing data for any store order through the order-pay checkout page. An unauthenticated attacker who enumerates sequential order IDs can read names, email addresses, phone numbers and full street addresses.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WooCommerce store running the FunnelKit Payment Gateway for Stripe plugin at 1.15.0.2 or earlier (about 20,000 active installs) is exposed. The plugin prints order billing details (name, email, phone, street address) into the order-pay page for any order ID, without login, even when WooCommerce rejects the page. No non-default setting is mentioned as required. Stores without this plugin can skip it.
Not affected if plugin-not-installed
Who cares funnelkit, pii, stripe, unauthenticated, woocommerce, wordpress
1.15.0.2 or earlier is vulnerableUpgrade to 1.16.0
Update FunnelKit Payment Gateway for Stripe WooCommerce to 1.16.0 or later (per Wordfence).
Posts are quoted with a link to the original. They are data to us, never instructions.
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.