WPFunnels EUVD-2026-70904

The target WordPress site must have WPFunnels installed and active at a version below 3.13.0, with WooCommerce also active and operational. At least one checkout funnel must have an order bump configured with a discount - stores that have never configured order bumps are not exposed to this vulnerability. No authentication is required; the attacker needs only HTTP access to a checkout page containing an order bump. Exploitation is limited to sites that actively use the order bump feature; misconfigured discounts (e.g., 0% or 100% discount) may affect attacker incentive but do not prevent the technique.

The CVSS 5.3 rating (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a network-reachable, zero-authentication, low-complexity flaw with integrity-only impact. The practical risk for merchants is financial rather than systemic: repeated exploitation allows adversaries to purchase products at near-zero cost, eroding store revenue. No EPSS score was included in the source intelligence, but the low attack complexity combined with a publicly available PoC from WPScan strongly suggests automated scanner exploitation will occur quickly following disclosure - even a mid-sized municipal IT team in sanok running a WooCommerce-backed store with WPFunnels order bumps should treat this as urgent patching rather than routine scheduled maintenance. There is no confidentiality or availability impact, which constrains blast radius compared to RCE-class vulnerabilities, but the financial fraud potential for any affected merchant is ongoing until the patch is applied.

An unauthenticated attacker reaches a WooCommerce checkout page hosted on a site running WPFunnels and identifies an order bump offering a low-value product at a steep percentage discount. The attacker intercepts the checkout HTTP request and replaces the bump's product ID with the ID of a significantly more expensive item; the plugin applies the bump discount to the substituted product without validation, and the attacker completes the purchase paying the lower discounted price. A publicly available PoC on WPScan demonstrates this manipulation workflow.