CVE-2026-109991
Deferred Deferred - Pending Action

Insecure Direct Object Reference in FunnelKit Payment Gateway for Stripe WooCommerce

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-109991
EUVD
EUVD-2026-119160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teamfunnelkit FunnelKit Payment Gateway for Stripe WooCommerce From 0 (inc) to 1.15.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 1.15.0.2. It allows unauthenticated attackers to access sensitive billing information like names, emails, phone numbers, and addresses by exploiting a missing validation on the 'order-pay' parameter. This data is exposed in the inline fkwcs_data JavaScript object on every matching page response.

Detection Guidance

To detect this vulnerability, check WordPress sites using the FunnelKit Payment Gateway for Stripe WooCommerce plugin versions up to 1.15.0.2. Look for exposed order-pay pages that leak PII in the fkwcs_data JavaScript object. Use curl to fetch pages like /checkout/order-pay/?order-pay=1 and inspect responses for billing details.

Impact Analysis

This vulnerability allows attackers to steal personally identifiable information (PII) such as billing addresses, emails, and phone numbers from any store order by guessing sequential order IDs. Even if WooCommerce blocks access to the order page, the plugin still exposes the data in its JavaScript object.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without authorization. It could lead to data breaches, fines, and legal consequences for organizations using the affected plugin.

Mitigation Strategies

Immediately update the FunnelKit Payment Gateway for Stripe WooCommerce plugin to the latest version. If an update is unavailable, disable the plugin until a patch is released. Review server logs for suspicious requests to /checkout/order-pay/ endpoints and restrict access to these pages if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...