CVE-2026-107746: FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wftyordermeta] or [wftyordertotal] shortcode.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to this issue?
Exposure requires a FunnelKit thank-you page that renders either the [wfty_order_meta] or [wfty_order_total] shortcode. Sites without those shortcode-rendering thank-you pages are not described as exploitable by the available information.
What does an attacker need to exploit it?
No authentication, privileges, or user interaction are required. An attacker can submit an enumerable sequential WooCommerce order ID through the order_id or order POST parameter to retrieve billing PII for orders on an exposed site.
What information could be disclosed?
The disclosed billing PII includes the customer's full name, street address, email address, and phone number. The issue is described as affecting any WooCommerce order whose sequential order ID can be enumerated.