EUVD-2026-39751
GHSA-744q-v2g8-3vv4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CSRF is network-delivered with no attacker privileges, but requires victim interaction; integrity impact is high as payment gateway settings can be altered, with no confidentiality or availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.
AnalysisAI
Cross-Site Request Forgery in FunnelKit Payment Gateway for Stripe WooCommerce plugin (versions up to and including 1.14.0.3) allows a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated WordPress user into interacting with a crafted request. The absence of proper CSRF token validation (CWE-352) means any action protected only by session authentication can be forged. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The affected component is the FunnelKit Payment Gateway for Stripe WooCommerce WordPress plugin, a payment processing extension for WooCommerce-based stores handling Stripe transactions. CSRF (CWE-352) vulnerabilities in WordPress plugins arise when server-side handlers for state-changing operations fail to validate WordPress nonces or equivalent CSRF tokens, allowing a third-party origin to submit authenticated requests on behalf of a logged-in user. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack is network-delivered, requires no attacker privileges, but does require user interaction - consistent with the classic CSRF social-engineering delivery model. No CPE string was provided in the input, but the affected product is identified as 'FunnelKit Payment Gateway for Stripe WooCommerce' at all versions up to and including 1.14.0.3.
RemediationAI
Update the FunnelKit Payment Gateway for Stripe WooCommerce plugin to a version above 1.14.0.3. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/funnelkit-stripe-woo-payment-gateway/vulnerability/wordpress-funnelkit-payment-gateway-for-stripe-woocommerce-plugin-1-14-0-3-cross-site-request-forgery-csrf-vulnerability should be consulted for the confirmed fixed version, as the exact patched release number was not included in the provided input data and cannot be independently stated here. If immediate patching is not feasible, a compensating control is to restrict access to WordPress admin and WooCommerce management interfaces to trusted IP ranges at the network or WAF layer, which reduces the exposure surface for CSRF delivery. Additionally, training administrators to avoid clicking unsolicited links while authenticated to the WordPress backend reduces social-engineering risk, though this is not a technical mitigation. No patch-independent workaround that eliminates the CSRF surface without disabling plugin functionality is available from the provided data.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today