Insecure Direct Object Reference in FunnelKit Payment Gateway for Stripe Plugin

CVE-2026-109991

What is CVE-2026-109991?

The FunnelKit Payment Gateway for Stripe plugin for WordPress is susceptible to an Insecure Direct Object Reference. This vulnerability affects all versions up to and including 1.15.0.2. It arises from inadequate validation on the 'order-pay' parameter, which allows unauthenticated attackers to access sensitive billing information, including names, email addresses, phone numbers, and full street addresses of any order by manipulating sequential order IDs. This data is inadvertently exposed through the inline fkwcs_data JavaScript object, regardless of WooCommerce's validation checks on the order requests.

References