CVE-2026-79630 in WPFunnels Plugin
Summary
by MITRE • 09/04/2026
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in WPFunnels versions prior to 3.13.0 represents a critical logic flaw within the WordPress plugin's checkout processing mechanism, specifically affecting the functionality known as order bumps. Order bumps are a common e-commerce strategy where merchants offer an additional product or upgrade at a discounted price during the final stages of a customer's purchase journey. The core issue lies in the server-side validation process, which fails to verify that the specific product ID submitted by the client matches the product ID for which the discount was originally configured and authorized by the merchant. This lack of integrity checking allows an unauthenticated attacker to manipulate the checkout parameters to substitute any purchasable item from the store's catalog into a transaction intended for a different, typically more expensive or distinct, product that carries the promotional pricing structure.
From a technical perspective, this flaw is classified under CWE-829, which denotes Inclusion of Functionality from an Untrusted Control Sphere, as well as CWE-602, Client-Side Enforcement of Server-Side Security, because the application relies on client-supplied data to determine discount eligibility without sufficient server-side validation. The attacker exploits this by intercepting or crafting HTTP requests during the checkout process and altering the product identifier associated with the order bump. Since the backend logic does not cross-reference the requested item against the configured promotion rules, it accepts the manipulated request as valid. Consequently, the system applies the discounted price intended for one specific SKU to a completely different SKU selected by the attacker. This bypasses standard access controls because no authentication is required; any visitor with basic knowledge of HTTP requests or browser developer tools can execute this manipulation against public-facing checkout pages.
The operational impact of this vulnerability extends beyond simple financial loss from discount abuse, although that is the primary consequence. By allowing unauthenticated users to obtain products at unauthorized discounts, attackers can effectively engage in price arbitrage, purchasing high-value items for significantly reduced costs and potentially reselling them for profit. This undermines the merchant's revenue model and pricing strategy. Furthermore, such manipulation can lead to inventory discrepancies if the system processes orders based on flawed data without proper stock validation against the actual promotional constraints. In a broader security context, this behavior aligns with ATT&CK technique T1589.002, Gather Victim Accounts or Information via Phishing, although in this specific instance, it is more accurately mapped to direct exploitation of business logic flaws rather than social engineering. It also reflects aspects of CWE-347, Improper Verification of Cryptographic Signature, if the discount codes were signed, but primarily sits as a failure in input validation and authorization checks for pricing rules.
Mitigation strategies must focus on implementing robust server-side validation that strictly enforces business logic constraints. Developers should ensure that when an order bump is processed, the system verifies not only that the product exists and is purchasable but also that it matches the specific item associated with the active discount or promotion rule. This involves maintaining a secure mapping between promotional identifiers and their eligible products on the server side, rather than trusting client-supplied data to define eligibility. Additionally, implementing rate limiting and anomaly detection for checkout transactions can help identify unusual patterns of bulk purchases at discounted rates. For users currently running affected versions, upgrading to version 3.13.0 or later is essential as it addresses this validation gap. Until the update is applied, merchants should consider temporarily disabling order bump features if they are not actively used, thereby removing the attack vector entirely from their live environment and preventing further exploitation by malicious actors seeking to abuse pricing structures.