CVE-2026-84908
Deferred Deferred - Pending Action

WPFunnels Plugin Missing Authorization to Cart Manipulation

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Wordfence

Description
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-84908
EUVD
EUVD-2026-74687

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpfunnels wpfunnels to 3.12.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPFunnels WordPress plugin has a vulnerability in versions up to 3.12.13 where unauthenticated users can manipulate product prices by adding arbitrary WooCommerce products to a cart at discounted prices. This occurs because the plugin allows unauthenticated AJAX actions without proper checks, enabling price manipulation and revenue loss.

Detection Guidance

To detect this vulnerability, check WordPress sites running the WPFunnels plugin version 3.12.13 or lower. Look for unauthorized cart additions or price manipulations in WooCommerce logs. No specific commands are provided in the context.

Impact Analysis

Unauthenticated attackers can add any WooCommerce product to a cart at a discounted price configured in a funnel step. This leads to price manipulation, potential revenue loss for store owners, and unauthorized discounts applied during checkout.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized access to pricing and product data, which may involve handling personal or sensitive information without proper authorization. Unauthenticated attackers could manipulate cart contents, leading to unauthorized transactions or exposure of user data.

Mitigation Strategies

Update the WPFunnels plugin to the latest version beyond 3.12.13 immediately. If an update is not available, consider disabling the plugin until a patch is released. Review WooCommerce cart and checkout logs for suspicious activity involving unauthorized product additions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart