# CVE-2026-79630: WPFunnels checkout order bump product substitution allowing price manipulation

Source: https://junglewise.ai/threats/cve-2026-79630-wpfunnels-checkout-order-bump-product-substitution-allowing-price  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79630 · Severity: medium · CVSS 5.3 · Published 2026-09-04

WPFunnels is a WordPress plugin that enables e-commerce sales funnels with promotional checkout features. The plugin fails to validate that discounted order bump products match the intended item, allowing unauthenticated buyers to substitute expensive products into low-price promotional discounts and complete purchases at drastically reduced prices. This results in direct revenue loss for merchants accepting discounted payments for full-price items.

Technologies: [WPFunnels](https://junglewise.ai/threats/technologies/wpfunnels). Vendors: [WPFunnels](https://junglewise.ai/threats/vendors/wpfunnels).

## Quick answers

**Is CVE-2026-79630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79630 being exploited in the wild.

**How severe is CVE-2026-79630?** Medium severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** WPFunnels before 3.13.0.

**Is there a fix for CVE-2026-79630?** A patch was published on 2026-09-04: Fixed in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79630?** Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the order bump checkout mechanism. The plugin accepts a product ID parameter in the wpfnl_order_bump_ajax AJAX action without validating that the requested product matches the discount configuration for that specific order bump. An unauthenticated attacker can supply a different product_id or variation_id while retaining the discount percentage intended for a cheaper item, causing WooCommerce to apply the reduced price to any substituted product. The attack requires only a valid WooCommerce session nonce (publicly available in page markup) and works against any checkout with order bumps enabled. Patches are available in version 3.13.0 and later.

## Affected products

- WPFunnels WPFunnels before 3.13.0

## Timeline

- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 3.13.0

## References

- [https://wpscan.com/vulnerability/fb49c59a-f79f-495c-a23e-0e1629cfa53e/](https://wpscan.com/vulnerability/fb49c59a-f79f-495c-a23e-0e1629cfa53e/)

## Related threats

- [WPFunnels missing authorization in AJAX payment handler](https://junglewise.ai/threats/cve-2026-84908-wpfunnels-missing-authorization-in-ajax-payment-handler)
- [WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler](https://junglewise.ai/threats/cve-2026-79632-wpfunnels-plugin-unauthenticated-arbitrary-email-sending-in-opt)
- [WPFunnels WordPress plugin information disclosure via web-accessible logs](https://junglewise.ai/threats/cve-2026-79631-wpfunnels-wordpress-plugin-information-disclosure-via-web)
- [WPFunnels WordPress plugin unauthenticated user registration bypass](https://junglewise.ai/threats/cve-2025-15691-wpfunnels-wordpress-plugin-unauthenticated-user-registration)
- [WPFunnels broken access control vulnerability](https://junglewise.ai/threats/cve-2026-84754-wpfunnels-broken-access-control-vulnerability)