{"id":"CVE-2026-109991","kind":"vulnerability","aliases":["CVE-2026-109991"],"related":[],"title":"FunnelKit Stripe plugin for WordPress leaks customer billing details by order ID","description":"The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.","summary":"The FunnelKit Payment Gateway for Stripe WooCommerce plugin up to and including 1.15.0.2 exposes billing data for any store order through the order-pay checkout page. An unauthenticated attacker who enumerates sequential order IDs can read names, email addresses, phone numbers and full street addresses.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"funnelkit-stripe-woo-payment-gateway","fixed":["1.16.0"],"affected":"<= 1.15.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["funnelkit","package","pii","stripe","unauthenticated","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the version of FunnelKit Payment Gateway for Stripe WooCommerce (slug funnelkit-stripe-woo-payment-gateway); 1.15.0.2 or earlier is vulnerable. Also in wp-content/plugins/funnelkit-stripe-woo-payment-gateway/ read the Version header. Check access logs for many different /checkout/order-pay/<ID>/ requests from one IP.","fix":"Update FunnelKit Payment Gateway for Stripe WooCommerce to 1.16.0 or later (per Wordfence).","status":"open","published_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:40+00:00","updated_at":"2026-11-07T12:52:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T12:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FunnelKit Stripe plugin for WordPress leaks customer billing details by order ID","impact":"medium","summary":"The FunnelKit Payment Gateway for Stripe WooCommerce plugin up to and including 1.15.0.2 exposes billing data for any store order through the order-pay checkout page. An unauthenticated attacker who enumerates sequential order IDs can read names, email addresses, phone numbers and full street addresses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","funnelkit","stripe"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Customer names, emails, phones and street addresses readable by anyone","analyst_note":"Check the NVD entry or the plugin vendor's changelog for a patched version after 1.15.0.2 and whether any non-default setting is required.","how_to_check":"- Check the installed version of the FunnelKit Payment Gateway for Stripe WooCommerce plugin in the WordPress plugins list, or look for the plugin folder and its version header.\n- Confirm whether the installed version is `1.15.0.2` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WooCommerce store running the FunnelKit Payment Gateway for Stripe plugin at version 1.15.0.2 or earlier is exposed, because the plugin prints order billing data into the order-pay page for any order ID. The sources do not say whether a non-default setting is required, so the exposure is assumed to apply to the default configuration. Stores that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4419,"output_tokens":635,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry or the plugin vendor's changelog for a patched version after 1.15.0.2 and whether any non-default setting is required.","search":"'-109991':15A,18A '-2026':14A,17A '/checkout/order-pay':112C '1.15.0.2':44B,102C 'address':71B,77B,139C,145C 'attack':61B,129C 'bill':8A,46B,134C 'call':196C 'checkout':57B 'complet':143C 'control':121C 'custom':7A 'cve':13A,16A 'data':47B,157C,164C 'detail':9A 'direct':92C 'due':114C 'email':70B,138C 'emit':159C 'enumer':63B,151C 'even':178C 'everi':172C 'exploit':176C 'expos':45B 'fkwcs':163C 'full':75B,133C 'funnelkit':1A,20A,25B,33B,79C 'funnelkit-stripe-woo-payment-gateway':19A 'gateway':24A,35B,81C 'id':12A,66B,154C 'includ':43B,101C,136C 'independ':198C 'inlin':162C 'insecur':91C 'javascript':165C 'key':122C,205C 'leak':6A 'local':169C,194C 'make':124C 'match':173C 'miss':116C 'name':69B,137C 'number':73B,141C 'object':93C,166C 'occur':177C 'order':11A,51B,55B,65B,106C,149C,153C,185C,204C 'order-key':203C 'order-pay':54B,105C,184C 'packag':26B 'page':58B,174C,187C 'paramet':113C 'pay':56B,107C,186C 'payment':23A,34B,80C 'phone':72B,140C 'pii':27B,135C 'plugin':3A,39B,85C,191C 'possibl':126C 'queri':109C 'read':68B,131C 'refer':94C 'reject':182C 'request':188C,210C 'respons':175C 'run':197C 'script':170C,195C 'sequenti':64B,152C 'store':50B,148C 'street':76B,144C 'stripe':2A,21A,28B,37B,83C 'unauthent':29B,60B,128C 'user':120C 'valid':117C,206C 'var':110C 'version':97C 'via':103C,167C 'vulner':89C 'woo':22A 'woocommerc':30B,38B,84C,180C,200C 'wordpress':5A,31B,87C 'wp':108C,168C,193C","nicknames":[],"mitigations":[],"who_affected":"Any WooCommerce store running the FunnelKit Payment Gateway for Stripe plugin at 1.15.0.2 or earlier (about 20,000 active installs) is exposed. The plugin prints order billing details (name, email, phone, street address) into the order-pay page for any order ID, without login, even when WooCommerce rejects the page. No non-default setting is mentioned as required. Stores without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["funnelkitstripewoopaymentgateway"],"ptokens":["funnelkit","gateway","payment","stripe","woo"],"labels":["funnelkit","high","package","pii","stripe","unauthenticated","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-109991':15A,18A '-2026':14A,17A 'bill':8A 'custom':7A 'cve':13A,16A 'detail':9A 'funnelkit':1A,20A 'funnelkit-stripe-woo-payment-gateway':19A 'gateway':24A 'id':12A 'leak':6A 'order':11A 'payment':23A 'plugin':3A 'stripe':2A,21A 'woo':22A 'wordpress':5A","search_b":"'1.15.0.2':44B 'address':71B,77B 'attack':61B 'bill':46B 'checkout':57B 'data':47B 'email':70B 'enumer':63B 'expos':45B 'full':75B 'funnelkit':25B,33B 'gateway':35B 'id':66B 'includ':43B 'name':69B 'number':73B 'order':51B,55B,65B 'order-pay':54B 'packag':26B 'page':58B 'pay':56B 'payment':34B 'phone':72B 'pii':27B 'plugin':39B 'read':68B 'sequenti':64B 'store':50B 'street':76B 'stripe':28B,37B 'unauthent':29B,60B 'woocommerc':30B,38B 'wordpress':31B","search_c":"'/checkout/order-pay':112C '1.15.0.2':102C 'address':139C,145C 'attack':129C 'bill':134C 'call':196C 'complet':143C 'control':121C 'data':157C,164C 'direct':92C 'due':114C 'email':138C 'emit':159C 'enumer':151C 'even':178C 'everi':172C 'exploit':176C 'fkwcs':163C 'full':133C 'funnelkit':79C 'gateway':81C 'id':154C 'includ':101C,136C 'independ':198C 'inlin':162C 'insecur':91C 'javascript':165C 'key':122C,205C 'local':169C,194C 'make':124C 'match':173C 'miss':116C 'name':137C 'number':141C 'object':93C,166C 'occur':177C 'order':106C,149C,153C,185C,204C 'order-key':203C 'order-pay':105C,184C 'page':174C,187C 'paramet':113C 'pay':107C,186C 'payment':80C 'phone':140C 'pii':135C 'plugin':85C,191C 'possibl':126C 'queri':109C 'read':131C 'refer':94C 'reject':182C 'request':188C,210C 'respons':175C 'run':197C 'script':170C,195C 'sequenti':152C 'store':148C 'street':144C 'stripe':83C 'unauthent':128C 'user':120C 'valid':117C,206C 'var':110C 'version':97C 'via':103C,167C 'vulner':89C 'woocommerc':84C,180C,200C 'wordpress':87C 'wp':108C,168C,193C","first_public_at":"2026-11-07T12:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109991","severity":null,"published_at":"2026-11-07T12:17:42+00:00","modified_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109991:2118","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter","severity":null,"published_at":"2026-11-07T12:52:32+00:00","modified_at":"2026-11-07T12:52:32+00:00","first_seen_at":"2026-11-07T12:52:32+00:00","fetched_at":"2026-11-07T12:52:32+00:00","note":"Wordfence (CNA) advisory: affected <= 1.15.0.2, patched 1.16.0, no non-default setting mentioned. Fix not seen on the vendor's own changelog, so nothing marked verified. wpsec's 1.15.0.0.1 fix is for a different, earlier 1.15.0 issue, not used. No exploitation or PoC reported; no X search done.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter","https://wordpress.org/plugins/funnelkit-stripe-woo-payment-gateway/"]}],"documents":[{"id":95565,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter","title":"Wordfence: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 IDOR","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95567,"url":"https://wordpress.org/plugins/funnelkit-stripe-woo-payment-gateway/","title":"FunnelKit Payment Gateway for Stripe WooCommerce (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}