Authorization Bypass in FunnelKit for WooCommerce Checkout Plugin

CVE-2026-107746

What is CVE-2026-107746?

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress suffers from an authorization bypass flaw that affects all versions up to and including 3.16.0.6. This vulnerability arises from improper user verification, enabling unauthenticated attackers to access sensitive billing personal identifiable information (PII)—such as the full name, street address, email address, and phone number—associated with WooCommerce orders. The vulnerability is particularly critical for sites that implement the FunnelKit thank-you page with the [wfty_order_meta] or [wfty_order_total] shortcode, allowing for a systematic exploitation of order IDs to extract user data.

References