FunnelKit Funnel Builder EUVD-2026-102649

Exploitable only on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode; this specific page/shortcode configuration is the hard prerequisite. Given that precondition, no authentication, privileges, or user interaction are required (CVSS PR:N/UI:N) and order IDs are sequential/enumerable, enabling automated bulk extraction. The limiting factor is the non-default requirement that the vulnerable shortcode be published on a reachable thank-you page - stores not using these shortcodes are not exposed.

This is a genuine medium-to-high priority data-exposure flaw, but not a drop-everything emergency. The Wordfence-provided CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N = 7.5) is internally consistent with the description: a remote, unauthenticated attacker can read confidential data with no user interaction and no privileges. The impact is scoped to confidentiality only (I:N/A:N) - attackers harvest billing PII but cannot alter orders or disrupt the site. Crucially, exploitation is gated by a site-specific precondition not reflected in the raw score: a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must already exist, so the real-world attack surface is narrower than AC:L/PR:N alone implies. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set; status is therefore 'no public exploit identified at time of analysis.' The sequential, enumerable order IDs make bulk scraping trivial once a vulnerable page is found, which raises practical severity for affected sites even though it is not confirmed as actively exploited. Net: a real priority for FunnelKit/WooCommerce operators who use thank-you-page shortcodes, lower urgency for those who do not.

An unauthenticated attacker locates a FunnelKit thank-you page that renders the [wfty_order_meta] or [wfty_order_total] shortcode, then scripts requests iterating through sequential order IDs (1, 2, 3, …). Because the plugin never verifies the requester owns the order, each request returns the customer's full name, street address, email, and phone number, allowing wholesale scraping of the store's customer PII. No public exploit code was identified in the provided data, but the attack is low-complexity and requires no authentication.