CVE-2026-79630: WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPFunnels WordPress pluginto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it. No account or authenticated WordPress session is required.
What does an attacker need to do to obtain the discounted price?
They need to request a different purchasable product through a checkout order bump while using the discount configured for that bump. The plugin does not verify that the requested product matches the product associated with the discount.
What is the business impact of successful exploitation?
An attacker can purchase any purchasable product at a discount intended for another product. The reduced price is retained in the order total they place.
Which plugin versions are affected?
WPFunnels versions before 3.13.0 are affected.