---
id: "CVE-2026-109991"
page: "https://infrastack.ai/live/CVE-2026-109991"
kind: "vulnerability"
aliases: ["CVE-2026-109991"]
title: "FunnelKit Stripe plugin for WordPress leaks customer billing details by order ID"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "funnelkit-stripe-woo-payment-gateway", "fixed": ["1.16.0"], "affected": "<= 1.15.0.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["funnelkit", "package", "pii", "stripe", "unauthenticated", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T12:17:42+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:52:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109991", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter", "first_seen_at": "2026-11-07T12:52:32+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter", "https://wordpress.org/plugins/funnelkit-stripe-woo-payment-gateway/"]}]
exploit_sources: []
---

# FunnelKit Stripe plugin for WordPress leaks customer billing details by order ID

Link for people: https://infrastack.ai/live/CVE-2026-109991 (this .md is for agents)

The FunnelKit Payment Gateway for Stripe WooCommerce plugin up to and including 1.15.0.2 exposes billing data for any store order through the order-pay checkout page. An unauthenticated attacker who enumerates sequential order IDs can read names, email addresses, phone numbers and full street addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:funnelkit-stripe-woo-payment-gateway affected <= 1.15.0.2 fixed 1.16.0

## How to check

In WordPress admin > Plugins, check the version of FunnelKit Payment Gateway for Stripe WooCommerce (slug funnelkit-stripe-woo-payment-gateway); 1.15.0.2 or earlier is vulnerable. Also in wp-content/plugins/funnelkit-stripe-woo-payment-gateway/ read the Version header. Check access logs for many different /checkout/order-pay/<ID>/ requests from one IP.

## Fix

Update FunnelKit Payment Gateway for Stripe WooCommerce to 1.16.0 or later (per Wordfence).

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109991
- 2026-11-07T12:52:32+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter — Wordfence (CNA) advisory: affected <= 1.15.0.2, patched 1.16.0, no non-default setting mentioned. Fix not seen on the vendor's own changelog, so nothing marked verified. wpsec's 1.15.0.0.1 fix is for a different, earlier 1.15.0 issue, not used. No exploitation or PoC reported; no X search done.

## Documents

- [advisory] Wordfence: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 IDOR https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/funnelkit-stripe-woo-payment-gateway/funnelkit-payment-gateway-for-stripe-woocommerce-11502-insecure-direct-object-reference-to-unauthenticated-sensitive-information-exposure-via-order-pay-url-path-parameter
- [describes] FunnelKit Payment Gateway for Stripe WooCommerce (wordpress.org) https://wordpress.org/plugins/funnelkit-stripe-woo-payment-gateway/

## From the sources

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_