Vulnerability · Published Oct 16, 2026 · Assigned by Wordfence

CVE-2026-107746FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter

High 7.5

In plain English

A high-severity missing authorization in FunnelKit – Funnel Builder Plugin for WooCommerce Checkout from teamfunnelkit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 75.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.

Affected products (as reported)

Vendor	Product	Versions
teamfunnelkit	FunnelKit – Funnel Builder Plugin for WooCommerce Checkout	0 – through 3.16.0.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References