CVE-2026-109991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109991", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-13T12:35:18.333Z", "datePublished": "2026-11-07T11:26:33.813Z", "dateUpdated": "2026-11-07T18:26:30.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-07T11:26:33.813Z"}, "affected": [{"vendor": "teamfunnelkit", "product": "FunnelKit Payment Gateway for Stripe WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.15.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII \u2014 including name, email address, phone number, and complete street address \u2014 of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request."}], "title": "FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3741799%40funnelkit-stripe-woo-payment-gateway&new=3741799%40funnelkit-stripe-woo-payment-gateway"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kuba"}], "timeline": [{"time": "2026-10-09T18:22:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-11-06T22:51:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-07T18:11:09.203527Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T18:26:30.640Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-07T18:11:09.203527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T18:24:03.873Z"}}], "cna": {"title": "FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Kuba"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "teamfunnelkit", "product": "FunnelKit Payment Gateway for Stripe WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.15.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-09T18:22:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-11-06T22:51:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317"}, {"url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3741799%40funnelkit-stripe-woo-payment-gateway&new=3741799%40funnelkit-stripe-woo-payment-gateway"}], "descriptions": [{"lang": "en", "value": "The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII \u2014 including name, email address, phone number, and complete street address \u2014 of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-07T11:26:33.813Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109991", "state": "PUBLISHED", "dateUpdated": "2026-11-07T18:26:30.640Z", "dateReserved": "2026-10-13T12:35:18.333Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-11-07T11:26:33.813Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FunnelKit Payment Gateway for Stripe WooCommerce", "vendor": "teamfunnelkit", "versions": [{"lessThanOrEqual": "1.15.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII \u2014 including name, email address, phone number, and complete street address \u2014 of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request."}], "id": "CVE-2026-109991", "lastModified": "2026-11-07T19:17:17.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109991", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-07T18:11:09.203527Z", "version": "2.0.3"}}]}, "published": "2026-11-07T12:17:42.267", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3741799%40funnelkit-stripe-woo-payment-gateway&new=3741799%40funnelkit-stripe-woo-payment-gateway"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"created": "2026-11-07T12:30:17.905210+00:00", "updated": "2026-11-07T12:30:17.905216+00:00", "vendors": []}