Funnelkit Funnel Builder Plugin For Woocommerce Checkout
Monthly
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.