CVE-2026-109991

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

• CWE-639

• https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295
• https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317
• https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3741799%40funnelkit-stripe-woo-payment-gateway&new=3741799%40funnelkit-stripe-woo-payment-gateway
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109985The xSpeed Cache: AI-Powered Performance Hub with MCP, Cachi…6.4
• CVE-2026-109987The PixelYourSite WordPress plugin before 11.4.3, PixelYour…7.2
• CVE-2026-109988The Product Addons for Woocommerce – Product Options with Cu…4.4
• CVE-2026-109989The Themify Popup plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-10999Integer overflow in ANGLE in Google Chrome on Windows prior …6.5
• CVE-2026-109990The Flying Scripts: Delay JavaScript to Improve Site Speed &…7.2
• CVE-2026-109994The Eventin – Events Calendar, Tickets, Registration, Bookin…6.5
• CVE-2026-109995The Advanced Views – Display Framework for Gutenberg & Eleme…7.2
• CVE-2026-109997The Ninja Forms – Contact Form Builder with Calculators, Qui…7.2
• CVE-2026-109998The Mang Board plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-109999The AI Marketing Expert — AI Email Marketing, AI Content Gen…7.2
• CVE-2026-11000Use after free in Fonts in Google Chrome on Linux prior to 1…8.8