Executive brief
WPFunnels is a WordPress plugin for managing sales funnels and checkout flows. The plugin's payment processing AJAX endpoint is accessible to unauthenticated users and fails to validate which products should be added to a cart, allowing attackers to manipulate product prices and bypass discount restrictions, resulting in direct revenue loss through unauthorized discounted transactions.
Technical details
The vulnerability is a missing authorization flaw in the wpfnl_load_payment AJAX action (class-wpfnl-offer.php). The action is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users, and the underlying add_offer_product_to_cart() function lacks nonce verification, capability checks, and product validation. An unauthenticated attacker can supply arbitrary product_id and step_id parameters to add any WooCommerce product to a cart at any discounted price configured on any funnel step. No authentication or authorization is required; the attack is network-reachable via a standard AJAX POST request. The attacker achieves direct price manipulation and checkout fraud.
Affected products
- WPFunnels WPFunnels up to and including 3.12.13
Timeline
- 2026-09-09: disclosed