CVE-2026-107746 teamfunnelkit CVE debrief

Who should care

Defenders responsible for WordPress sites using the FunnelKit – Funnel Builder for WooCommerce Checkout plugin, particularly those with publicly accessible thank-you pages using the [wfty_order_meta] or [wfty_order_total] shortcode, should assess exposure and verify that their sites are not vulnerable to unauthorized access to WooCommerce order billing information.

Why it matters

The FunnelKit authorization bypass vulnerability allows unauthenticated attackers to retrieve sensitive billing information for any WooCommerce order on a vulnerable site. Defenders should prioritize verifying the presence of FunnelKit thank-you pages and checking for unauthorized access to order information.

• Verify the presence of FunnelKit thank-you pages using the [wfty_order_meta] or [wfty_order_total] shortcode
• Check for unauthorized access to WooCommerce order billing information
• Restrict access to sensitive order information
• Monitor for suspicious activity related to order IDs

Technical summary

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID.

Defensive priority

Defenders should prioritize verifying the presence of FunnelKit thank-you pages using the [wfty_order_meta] or [wfty_order_total] shortcode and checking for unauthorized access to WooCommerce order billing information.

Recommended defensive actions

• Verify the presence of FunnelKit thank-you pages using the [wfty_order_meta] or [wfty_order_total] shortcode
• Check for unauthorized access to WooCommerce order billing information
• Restrict access to sensitive order information
• Monitor for suspicious activity related to order IDs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is due to the plugin not properly verifying that a user is authorized to perform an action. The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are fixed or provide additional information on exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.