Is CVE-2026-107746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107746 being exploited in the wild.

How severe is CVE-2026-107746?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

FunnelKit – Funnel Builder for WooCommerce Checkout up to and including 3.16.0.6.

Is there a fix for CVE-2026-107746?

Yes: fixed in 3.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107746 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107746?

Check whether you run FunnelKit – Funnel Builder for WooCommerce Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107746: FunnelKit Funnel Builder authorization bypass in order data retrieval

CVE-2026-107746 · Severity: high · CVSS 7.5 · Published 2026-10-16

FunnelKit is a WordPress plugin that builds checkout funnels for WooCommerce stores. An unauthenticated attacker can retrieve sensitive customer billing information — including names, addresses, emails, and phone numbers — from any WooCommerce order by guessing sequential order IDs, provided the site has a thank-you page using specific FunnelKit shortcodes. This exposes customer personal information at scale.

Technologies: FunnelKit – Funnel Builder for WooCommerce Checkout. Vendors: FunnelKit.

Quick answers

Is CVE-2026-107746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107746 being exploited in the wild.
How severe is CVE-2026-107746?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: FunnelKit – Funnel Builder for WooCommerce Checkout up to and including 3.16.0.6.
Is there a fix for CVE-2026-107746?: Yes: fixed in 3.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107746 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107746?: Check whether you run FunnelKit – Funnel Builder for WooCommerce Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.17.0

Technical details

The plugin fails to properly authorize access to order data in the thank-you page handler, allowing unauthenticated enumeration of order IDs and retrieval of billing PII via the [wfty_order_meta] or [wfty_order_total] shortcodes. The vulnerability requires no authentication and relies on predictable sequential order IDs; the attack surface is limited to sites with thank-you pages rendering these shortcodes. A fix is available in version 3.17.0 and later.

Affected products

FunnelKit FunnelKit – Funnel Builder for WooCommerce Checkout up to and including 3.16.0.6

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.