CVE-2026-84908 in WPFunnels Plugin
Summary
by MITRE • 09/09/2026
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in WPFunnels versions up to 3.12.13 represents a critical failure in access control mechanisms within the WordPress ecosystem. This flaw is classified as Missing Authorization, which corresponds directly to CWE-862: Missing Authorization. The core of the issue lies in how the plugin registers its AJAX endpoints for handling payment-related actions. Specifically, the 'wpfnl_load_payment' action is registered using both wp_ajax and wp_ajax_nopriv hooks. In WordPress architecture, registering an action under wp_ajax_nopriv explicitly allows unauthenticated users to execute that function without any prior login or session validation. This design choice creates a direct pathway for attackers who do not possess valid credentials to interact with sensitive backend logic intended only for verified customers or administrators.
The technical execution of this vulnerability relies on the absence of multiple layers of security verification within the underlying add_offer_product_to_cart() function. First, there is no nonce verification present in the request handling process. Nonces are essential in WordPress development to prevent Cross-Site Request Forgery attacks by ensuring that a request was intentionally made by an authenticated user through the intended interface. Second, and more critically for this specific flaw, there is no capability check performed before processing the request. The function proceeds to execute logic based solely on parameters supplied by the client side without verifying if the requester has permission to perform such actions. This lack of server-side authorization checks allows any external actor to invoke the function at will.
Furthermore, the validation logic for product identifiers is severely deficient. The system fails to validate that the attacker-supplied product_id actually corresponds to an offer product configured on the specified step_id within a funnel. In a secure implementation, the backend must cross-reference the requested item against the legitimate configuration of the sales funnel to ensure integrity. By omitting this validation, the application trusts client-side input implicitly. This allows an unauthenticated attacker to manipulate the cart contents by injecting arbitrary WooCommerce products into a user's session or creating new sessions with these items pre-loaded. The attacker can exploit the discount logic associated with specific funnel steps to apply pricing rules that were not intended for those particular products.
The operational impact of this vulnerability is significant, primarily centering on price manipulation and direct revenue loss. Because unauthenticated users can add arbitrary products to a cart at discounted prices configured for other items or funnels, they can effectively bypass standard e-commerce controls. For instance, an attacker could configure a request that adds a high-value item to the cart while applying the discount rate intended for a low-cost promotional item during checkout. This leads to transactions being processed at incorrect, often substantially lower, price points than what is publicly advertised or logically permitted by the store's pricing structure. Such exploitation undermines the financial integrity of WooCommerce stores and can result in substantial monetary losses if left unpatched.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation and Defense Evasion, specifically leveraging improper access control mechanisms to achieve unauthorized objectives. The ability to manipulate cart contents without authentication also touches upon aspects of data manipulation that could be used in conjunction with other attacks to defraud payment gateways or trigger chargebacks through manipulated order values.
Mitigation for this vulnerability requires immediate updates to the WPFunnels plugin to a version where these authorization checks have been implemented correctly. Developers must ensure that AJAX endpoints handling sensitive operations like cart modifications are registered exclusively under wp_ajax, restricting access to authenticated users only. Additionally, robust server-side validation is essential; every request must include and verify a valid nonce to prevent CSRF attacks. Capability checks using WordPress functions such as current_user_can() should be enforced before executing any business logic related to pricing or product addition. Finally, strict input validation must ensure that the product_id provided in requests matches an offer explicitly configured for the referenced step_id within the funnel structure, thereby preventing arbitrary price manipulation and ensuring data integrity throughout the checkout process.