CVE-2026-84908: WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated (wpajaxnopriv) users and the underlying addofferproducttocart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied productid is the offer product actually configured on the attacker-supplied stepid. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPFunnels pluginto a version that resolves this vulnerability.Fixed in 3.12.13 - Configuration
Update WPFunnels so that the 'wpfnl_load_payment' AJAX action is not registered for unauthenticated users (wp_ajax_nopriv_) and the underlying add_offer_product_to_cart() performs nonce verification, a capability check, and validates that attacker-supplied product_id corresponds to the offer product configured for the attacker-supplied step_id.
WordPress WPFunnels plugin (AJAX action: wpfnl_load_payment) wp_ajax_nopriv_ registration / nonce & capability checks = disable unauthenticated access for wpfnl_load_payment and ensure nonce verification + capability check + step_id/product_id validation in add_offer_product_to_cart()
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it. No account, nonce, or WordPress capability is required.
What conditions must be present for price manipulation to work?
The site must use an affected WPFunnels version and have discounted prices configured on funnel steps. An attacker can supply a product ID and step ID without the plugin verifying that the product is the offer configured for that step.
What is the practical impact on an affected store?
An attacker can add arbitrary WooCommerce products to a cart using a discounted price configured on any funnel step. This can result in unauthorized discounted purchases and revenue loss at checkout.
Are sites affected in their default public-facing configuration?
Yes. The vulnerable wpfnl_load_payment AJAX action is registered for unauthenticated users, so exploitation does not depend on the attacker being logged in.