CVE-2026-107746 in FunnelKit

Summary

An authorization bypass vulnerability exists in the FunnelKit – Funnel Builder Plugin for WooCommerce Checkout. This flaw allows unauthenticated attackers to retrieve sensitive billing Personally Identifiable Information (PII). The vulnerability affects versions up to and including 3.16.0.6 and is patched in version 3.17.0. There is no evidence of active exploitation at this time.

Affected and patched versions

• FunnelKit – Funnel Builder Plugin for WooCommerce Checkout (plugin funnel-builder): affected 3.16.0.6 and earlier; fixed in 3.17.0

Is my site vulnerable?

To determine if your WordPress site is vulnerable to CVE-2026-107746, you need to check the version of the FunnelKit – Funnel Builder Plugin for WooCommerce Checkout installed on your system.

You can check the plugin version through your WordPress administration dashboard:

1. Log in to your WordPress admin area.

2. Navigate to the "Plugins" section.

3. Locate "FunnelKit – Funnel Builder for WooCommerce Checkout" in the list of installed plugins.

4. The version number will be displayed next to the plugin name.

Alternatively, if you have command-line access to your server, you can use WP-CLI to check the plugin version:

wp plugin get funnel-builder --field=version

If the displayed version is 3.16.0.6 or earlier, your site is vulnerable, provided it also meets the additional condition for exploitability. The vulnerability is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode. Review your FunnelKit thank-you pages to confirm if these shortcodes are in use. If your site uses a vulnerable version of the plugin and has a thank-you page with either of these shortcodes, it is susceptible to this authorization bypass.

What an attacker actually does

This vulnerability involves an authorization bypass within the FunnelKit – Funnel Builder Plugin for WooCommerce Checkout. The plugin, in versions up to and including 3.16.0.6, does not properly verify that a user is authorized to perform certain actions. This oversight creates a pathway for unauthenticated attackers to access sensitive customer data without needing to log in or have any special permissions.

An attacker exploits this flaw by targeting a WordPress site running the vulnerable FunnelKit plugin. The attack specifically requires the presence of a FunnelKit thank-you page that incorporates either the [wfty_order_meta] or [wfty_order_total] shortcode. These shortcodes are designed to display order-related information to legitimate customers after a purchase. However, due to the authorization bypass, an attacker can craft requests to these thank-you pages without needing to be logged in or possess any specific permissions.

By submitting enumerable sequential order IDs, an attacker can systematically request information for various WooCommerce orders. The plugin's failure to validate the attacker's authorization allows it to retrieve and display billing Personally Identifiable Information (PII) associated with each order ID. This PII includes the customer's full name, street address, email address, and phone number. The attacker can then collect this sensitive data for any order on the site where the specific thank-you page configuration is present.

How to detect a compromise

Detecting a compromise related to CVE-2026-107746 involves looking for unusual access patterns and data retrieval activities on your WordPress site. Since the vulnerability allows unauthenticated attackers to retrieve billing PII by enumerating sequential order IDs through FunnelKit thank-you pages, monitoring access logs is a primary method for detection.

Indicators of compromise may include:

• Unusual access patterns to thank-you pages: Look for a high volume of requests to FunnelKit thank-you page URLs (e.g., /thank-you/ or similar custom paths) from unauthenticated users or suspicious IP addresses.

• Sequential order ID requests: Attackers are likely to attempt to enumerate order IDs. Review web server access logs for requests to thank-you pages that include order_id parameters showing a sequential pattern (e.g., ?order_id=1001, ?order_id=1002, ?order_id=1003, and so on).

• Requests from unusual geographical locations or user agents: A sudden increase in requests from IP addresses not typically associated with your customer base or from generic user agents could indicate automated scanning or exploitation attempts.

• Increased server load: A sustained attempt to enumerate order IDs could lead to an unusual increase in server resource usage, particularly for database queries related to order metadata.

To investigate further, examine your web server access logs (e.g., Apache access.log, Nginx access.log). You can use command-line tools to search for relevant patterns.

Example grep command to search for requests to common thank-you page paths with order_id parameters:

grep -E 'GET /[^ ]*/thank-you/[^ ]*order_id=[0-9]+' /var/log/apache2/access.log | less

(Adjust the path to your access log file and the thank-you page URL pattern as necessary for your specific site configuration.)

Review the output for multiple requests from the same IP address attempting to access different, sequentially numbered order IDs. Pay attention to the HTTP status codes; a successful retrieval would typically result in a 200 OK status. If your site logs include user agent strings, look for patterns of enumeration from the same user agent. While direct database modification is not the primary attack vector for this specific vulnerability, the focus should remain on external access patterns that indicate unauthorized data retrieval.

How to fix

To address CVE-2026-107746 and protect your site from this authorization bypass vulnerability, follow these steps:

1. Update the FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: The vulnerability is patched in version 3.17.0. Update your plugin to this version or a newer one immediately.

   • Log in to your WordPress administration dashboard.

   • Navigate to "Plugins" > "Installed Plugins".

   • Locate "FunnelKit – Funnel Builder for WooCommerce Checkout" in the list.

   • If an update is available, click the "Update Now" link beneath the plugin name.

   • If you do not see an update link, refresh your plugin list or check the WordPress.org plugin repository for the latest version.

   • Always back up your site before performing any updates.

2. Verify FunnelKit thank-you page shortcode usage: Ensure that if you have custom FunnelKit thank-you pages, they are not inadvertently exposing more information than necessary. While the update should mitigate the authorization bypass, it is good practice to review the content rendered by [wfty_order_meta] or [wfty_order_total] shortcodes. Confirm that these shortcodes are only used where appropriate and that no other sensitive information is displayed unnecessarily.

3. Implement Web Application Firewall (WAF) rules: If you use a WAF, consider implementing rules that detect and block attempts to enumerate sequential order_id parameters on your thank-you pages, especially from unauthenticated users. This can provide an additional layer of defense by filtering malicious requests before they reach your WordPress application.

4. Regularly review access logs: Continue to monitor your web server access logs for the patterns described in the "How to detect a compromise" section, even after updating. This helps ensure that no residual exploitation attempts are occurring and provides ongoing visibility into your site's security posture. Consistent log review is a key component of maintaining site security.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-107746

• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f

• https://wordpress.org/plugins/funnel-builder/