EUVD-2026-70904
GHSA-j565-xvv2-774h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no authentication or user interaction required; integrity impact is low (price manipulation only) with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
AnalysisAI
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have WPFunnels installed and active at a version below 3.13.0, with WooCommerce also active and operational. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 rating (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a network-reachable, zero-authentication, low-complexity flaw with integrity-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WPFunnels to version 3.13.0 or later, which introduces server-side validation ensuring that the product requested via an order bump corresponds to the product the bump discount was configured for; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all ve
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visi
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remot
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthentic
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers t
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remot
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnel
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today