Executive brief
WPFunnels is a WordPress plugin that enables e-commerce sales funnels with promotional checkout features. The plugin fails to validate that discounted order bump products match the intended item, allowing unauthenticated buyers to substitute expensive products into low-price promotional discounts and complete purchases at drastically reduced prices. This results in direct revenue loss for merchants accepting discounted payments for full-price items.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the order bump checkout mechanism. The plugin accepts a product ID parameter in the wpfnl_order_bump_ajax AJAX action without validating that the requested product matches the discount configuration for that specific order bump. An unauthenticated attacker can supply a different product_id or variation_id while retaining the discount percentage intended for a cheaper item, causing WooCommerce to apply the reduced price to any substituted product. The attack requires only a valid WooCommerce session nonce (publicly available in page markup) and works against any checkout with order bumps enabled. Patches are available in version 3.13.0 and later.
Affected products
- WPFunnels WPFunnels before 3.13.0
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 3.13.0