UPSELL-ORDER-BUMP-OFFER-FOR-WOOCOMMERCE · CVE-2026-115431 · Package
FIX → 3.1.7
Upsell Order Bump Offer for WooCommerce, a WordPress plugin by WP Swings, is missing an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control to act beyond their permissions.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running WooCommerce with the WP Swings Upsell Order Bump Offer for WooCommerce plugin (also listed as Upsell Funnel Builder for WooCommerce) at 3.1.6 or earlier. It is a missing-authorization flaw (CWE-862); the CVSS vector indicates a low-privileged account is needed (PR:L), with limited integrity impact and high availability impact. Patchstack does not say which action is unprotected. A separate WPSec entry for the same version range describes Subscriber-level offer page creation and post content overwrite, but no source links it to this CVE. Sites without the plugin can skip it.
Not affected if plugin-not-installed
Who cares plugin, woocommerce, wordpress, wp-swings
Upsell Funnel Builder for WooCommerce / slug upsell-order-bump-offer-for-woocommerce3.1.6 and earlier are affected; 3.1.7 is the patched version per PatchstackPosts are quoted with a link to the original. They are data to us, never instructions.
Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.1.7
Update Upsell Order Bump Offer for WooCommerce (now named Upsell Funnel Builder for WooCommerce) to 3.1.7 or later