WPFunnels CVE-2026-84908

The wpfnl_load_payment AJAX action is registered via wp_ajax_nopriv_ in WPFunnels ≤3.12.13, making it reachable by any unauthenticated HTTP client - no session cookie, no WordPress login, and no CSRF token are required. Exploitation requires: (1) WPFunnels ≤3.12.13 installed and active on the target WordPress site; (2) WooCommerce active (WPFunnels depends on it); and (3) at least one funnel step with a configured offer discount present. The attacker must supply a valid step_id, typically discoverable by visiting funnel landing pages whose URLs or page source expose step identifiers, and a product_id integer, which is sequentially assigned and inferrable from any public WooCommerce product URL. No elevated privilege, non-default configuration, or special network position is required - exploitation is viable from any internet-connected client against any publicly accessible WooCommerce store running the affected plugin version.

The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) vector correctly captures the unauthenticated network-reachable nature of the flaw, though the I:L rating may understate the business consequence for active WooCommerce merchants - even a mid-sized e-commerce operator in inowroclaw running regular promotional funnels could sustain meaningful revenue losses if attackers systematically exploit the price manipulation to purchase high-value items at deep discounts. The attack is trivially automatable: no authentication, no complex preconditions, a single crafted POST to a standard WordPress AJAX endpoint. No EPSS data was provided, and the vulnerability does not appear in CISA KEV, so confirmed active exploitation has not been reported. However, public availability of source code diffs via WordPress Plugin Trac lowers the barrier to exploit construction significantly. Exploitation is gated only on the presence of active funnel steps with configured discounts - sites with WPFunnels installed but no configured funnels have substantially reduced exposure.

An unauthenticated attacker browses a WooCommerce storefront running WPFunnels, identifies a valid step_id from funnel landing page source or URL parameters, and sends a single crafted POST to wp-admin/admin-ajax.php with action=wpfnl_load_payment, a chosen high-value product_id, and the discount-bearing step_id. No public exploit code has been identified, but the attack amounts to a trivial AJAX POST - any attacker reviewing the public Trac source diffs could construct a working proof of concept within minutes. The targeted product is added to the cart at the funnel step's discount price, enabling checkout completion at a fraction of the retail cost.