CVE-2026-81649: Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

Q: Which stores are exposed to stored cross-site scripting?

Stores using the classic WooCommerce checkout are exposed because attacker-controlled script can be stored in a field that is output without escaping there. Stores using the block-based checkout are not identified as affected by this XSS condition.

Q: Does exploitation require an attacker account or store-specific credentials?

No. The affected REST API routes can be accessed without authentication because the plugin relies on a credential that is identical across installations.

Q: What could an attacker do through the exposed routes?

An attacker could disclose payment credentials and customer order data, overwrite payment gateway settings to redirect payments, and mark unpaid orders as paid. They can also store script for execution in the classic checkout.

Q: How can I determine whether my deployment is affected?

The issue affects the Fundiin cho WooCommerce WordPress plugin through version 3.4.0. If the store uses the classic checkout, it is also subject to the described stored XSS impact.

Published Oct 11, 2026

Updated

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.

Affected Software

1 affected component

Fundiin Fundiin cho WooCommerce WordPress plugin<=3.4.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which stores are exposed to stored cross-site scripting?

Stores using the classic WooCommerce checkout are exposed because attacker-controlled script can be stored in a field that is output without escaping there. Stores using the block-based checkout are not identified as affected by this XSS condition.

Does exploitation require an attacker account or store-specific credentials?

No. The affected REST API routes can be accessed without authentication because the plugin relies on a credential that is identical across installations.

What could an attacker do through the exposed routes?

An attacker could disclose payment credentials and customer order data, overwrite payment gateway settings to redirect payments, and mark unpaid orders as paid. They can also store script for execution in the classic checkout.

How can I determine whether my deployment is affected?

The issue affects the Fundiin cho WooCommerce WordPress plugin through version 3.4.0. If the store uses the classic checkout, it is also subject to the described stored XSS impact.

CVE-2026-81649: Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

Affected Software

Event History

Frequently Asked Questions

Which stores are exposed to stored cross-site scripting?

Does exploitation require an attacker account or store-specific credentials?

What could an attacker do through the exposed routes?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which stores are exposed to stored cross-site scripting?

Does exploitation require an attacker account or store-specific credentials?

What could an attacker do through the exposed routes?

How can I determine whether my deployment is affected?