Is CVE-2026-57635 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57635 being exploited in the wild.

How severe is CVE-2026-57635?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Which products and versions are affected?

FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3.

Is there a fix for CVE-2026-57635?

A patch was published on 2026-06-26: Version 1.14.0.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57635 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57635?

Check whether you run FunnelKit Payment Gateway for Stripe WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57635: FunnelKit Payment Gateway for Stripe WooCommerce CSRF

Q: Is there a fix for CVE-2026-57635?

A patch was published on 2026-06-26: Version 1.14.0.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57635 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57635?

Check whether you run FunnelKit Payment Gateway for Stripe WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57635 · Severity: medium · CVSS 6.5 · Published 2026-06-26

FunnelKit Payment Gateway for Stripe WooCommerce is a WordPress plugin used to process credit card payments via Stripe. A security flaw exists where an attacker can trick an administrator into performing unintended actions on the site, such as changing payment settings. This could lead to unauthorized configuration changes that disrupt business operations or redirect payment flows.

Vendors: FunnelKit.

Quick answers

Is CVE-2026-57635 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57635 being exploited in the wild.
How severe is CVE-2026-57635?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3.
Is there a fix for CVE-2026-57635?: A patch was published on 2026-06-26: Version 1.14.0.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57635 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57635?: Check whether you run FunnelKit Payment Gateway for Stripe WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress due to insufficient nonce validation on sensitive administrative functions. An unauthenticated remote attacker can exploit this by tricking a logged-in administrator into clicking a specially crafted link or visiting a malicious webpage. If successful, the attacker can force the administrative user to execute unintended state-changing actions within the plugin's configuration. The vulnerability is present in versions up to and including 1.14.0.3 and is resolved in version 1.14.0.4.

Affected products

FunnelKit FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3

Timeline

2026-05-07: other: Reported by ParkHyunWoo
2026-06-26: disclosed: Published by Patchstack
2026-06-26: patched: Version 1.14.0.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.