CVE-2026-57635
Deferred Deferred - Pending Action
Unauthenticated CSRF in FunnelKit Payment Gateway for Stripe WooCommerce

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-57635
EUVD
EUVD-2026-39751
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
funnelkit funnelkit_payment_gateway_for_stripe_woocommerce to 1.14.0.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated Cross Site Request Forgery (CSRF) in the FunnelKit Payment Gateway for Stripe WooCommerce plugin, versions 1.14.0.3 and below.

It allows a malicious actor to trick higher privileged users into executing unwanted actions by making them click a malicious link or visit a crafted page while they are authenticated.

The vulnerability requires user interaction and is classified under OWASP Top 10 A1: Broken Access Control.

Impact Analysis

If exploited, this vulnerability could allow attackers to force privileged users to perform unintended actions within the FunnelKit Payment Gateway plugin.

This could lead to unauthorized changes or operations being executed under the user's authentication, potentially compromising the integrity of payment processing or related configurations.

The impact is considered low severity but still significant enough to warrant immediate patching.

Detection Guidance

This vulnerability affects the FunnelKit Payment Gateway for Stripe WooCommerce plugin versions 1.14.0.3 and below. Detection involves verifying the plugin version installed on your WordPress site.

You can check the installed plugin version via the WordPress admin dashboard under Plugins, or by using command line tools to inspect the plugin files.

For command line detection, you can use the following commands on your server hosting WordPress:

  • Navigate to the WordPress plugins directory, usually wp-content/plugins/funnelkit-stripe-woo-payment-gateway/
  • Run: grep 'Version' funnelkit-stripe-woo-payment-gateway.php
  • Or use WP-CLI to check the plugin version: wp plugin list --status=active | grep funnelkit

If the version is 1.14.0.3 or below, your system is vulnerable to this CSRF issue.

Mitigation Strategies

The immediate recommended step is to update the FunnelKit Payment Gateway for Stripe WooCommerce plugin to version 1.14.0.4 or later, where the vulnerability is patched.

If updating immediately is not possible, consider disabling the plugin temporarily or restricting access to the WordPress admin area to trusted users only.

Users of Patchstack can enable auto-updates for vulnerable plugins to ensure timely patching.

Additionally, consult with your hosting provider or web developer for assistance in applying the patch or implementing further mitigations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart