# CVE-2026-107746: FunnelKit Funnel Builder authorization bypass in order data retrieval

Source: https://junglewise.ai/threats/cve-2026-107746-the-funnelkit-funnel-builder-for-woocommerce-checkout-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107746 · Severity: high · CVSS 7.5 · Published 2026-10-16

FunnelKit is a WordPress plugin that builds checkout funnels for WooCommerce stores. An unauthenticated attacker can retrieve sensitive customer billing information — including names, addresses, emails, and phone numbers — from any WooCommerce order by guessing sequential order IDs, provided the site has a thank-you page using specific FunnelKit shortcodes. This exposes customer personal information at scale.

Technologies: [FunnelKit – Funnel Builder for WooCommerce Checkout](https://junglewise.ai/threats/technologies/funnel-builder-for-woocommerce-checkout). Vendors: [FunnelKit](https://junglewise.ai/threats/vendors/funnelkit).

## Quick answers

**Is CVE-2026-107746 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107746 being exploited in the wild.

**How severe is CVE-2026-107746?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** FunnelKit – Funnel Builder for WooCommerce Checkout up to and including 3.16.0.6.

**Is there a fix for CVE-2026-107746?** Yes: fixed in 3.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107746 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107746?** Check whether you run FunnelKit – Funnel Builder for WooCommerce Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.17.0

## Technical details

The plugin fails to properly authorize access to order data in the thank-you page handler, allowing unauthenticated enumeration of order IDs and retrieval of billing PII via the [wfty_order_meta] or [wfty_order_total] shortcodes. The vulnerability requires no authentication and relies on predictable sequential order IDs; the attack surface is limited to sites with thank-you pages rendering these shortcodes. A fix is available in version 3.17.0 and later.

## Affected products

- FunnelKit FunnelKit – Funnel Builder for WooCommerce Checkout up to and including 3.16.0.6

## Timeline

- 2026-10-16: disclosed

## References

- [https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip](https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip)
- [https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php](https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php)