Vulnerability alerts / November 7, 2026

Vulnerability in FunnelKit Payment Gateway for Stripe WooCommerce — CVE-2026-109991

HighSeverity
CVSS 7.5

—Estimated exploit probability
EPSS

20,000+ sitesInstalls

1.16.0Fixed in

What to do now

Update FunnelKit Payment Gateway for Stripe WooCommerce to 1.16.0 or later.

Affected versions

Everything up to and including 1.15.0.2

Affected: FunnelKit Payment Gateway for Stripe WooCommerce (plugin, funnelkit-stripe-woo-payment-gateway)

Check: The plugin on wordpress.org / Our record for FunnelKit Payment Gateway for Stripe WooCommerce

What the vulnerability is

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

This description is reproduced verbatim from the public vulnerability record.

Sources

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts