Fundiin WooCommerce CVE-2026-81649

The core flaw requires no special conditions: several REST API routes enforce authorization only via a credential that is hardcoded identically across every installation, so remote unauthenticated attackers can invoke the credential-disclosure, order-data, gateway-reconfiguration, and mark-as-paid functions against default installs of the Fundiin cho WooCommerce plugin (version ≤3.4.0). The one explicitly limiting factor is for the stored-XSS component: it only affects stores using the classic WooCommerce checkout, because the injected script is output unescaped there - stores configured with the block-based checkout are not vulnerable to the XSS (though they remain exposed to the authorization-bypass data/financial impacts). Overall exposure is further bounded by whether the Fundiin plugin is installed and active at all.

All signals point to a genuine high-priority issue rather than a CVSS-inflated one. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) is fully consistent with the description: the plugin relies on a credential that is identical on every installation, which is functionally equivalent to no authorization (CWE-863), so any remote, unauthenticated attacker can reach the vulnerable REST routes with low complexity. Publicly available exploit code exists (reported by WPScan), which materially raises real-world risk, though this is distinct from confirmed active exploitation - the CVE is NOT in CISA KEV, and no EPSS score was supplied, so widespread automated exploitation cannot be confirmed from the data. No SSVC decision data was provided. The impact is severe and multi-faceted (payment-credential and customer-order disclosure, payment-gateway reconfiguration to redirect funds, fraudulent marking of orders as paid, and unauthenticated stored XSS on classic checkout), making it attractive for financially motivated attackers. The main factor limiting blast radius is deployment footprint: this is a niche BNPL payment plugin, not ubiquitous software, so exploitation is likely to be opportunistic/targeted against stores that run it rather than internet-wide.

An unauthenticated attacker locates a WooCommerce store running the Fundiin plugin and sends crafted HTTP requests to its unprotected REST API routes using the shared, install-independent credential. They dump the store's payment credentials and customer order data, rewrite the payment-gateway configuration so future payments are credited to an attacker-controlled account, and mark unpaid orders as paid; a public exploit (WPScan) exists. On stores using the classic (non-block) checkout, they can also store arbitrary script in an unescaped field, yielding stored XSS against checkout visitors.