EUVD-2026-74687
GHSA-cr4w-84pm-5qc4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable unauthenticated AJAX endpoint with no complexity barriers; impact limited to cart price manipulation with no confidentiality or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
AnalysisAI
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthenticated attackers add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step. The wpfnl_load_payment AJAX action is exposed via wp_ajax_nopriv_ with no nonce verification, no capability check, and no server-side validation confirming the caller-supplied product_id corresponds to the configured offer on the specified step_id. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The `wpfnl_load_payment` AJAX action is registered via `wp_ajax_nopriv_` in WPFunnels ≤3.12.13, making it reachable by any unauthenticated HTTP client - no session cookie, no WordPress login, and no CSRF token are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) vector correctly captures the unauthenticated network-reachable nature of the flaw, though the I:L rating may understate the business consequence for active WooCommerce merchants - even a mid-sized e-commerce operator in inowroclaw running regular promotional funnels could sustain meaningful revenue losses if attackers systematically exploit the price manipulation to purchase high-value items at deep discounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WPFunnels to the version released after 3.12.13 via the WordPress plugin dashboard or the official WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users hol
Local File Inclusion in the WPFunnels WordPress plugin (all versions through 3.12.7) allows authenticated administrators
Stored cross-site scripting (XSS) in WPFunnels - Easy Funnel Builder plugin for WordPress versions up to 3.7.9 allows au
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today