# CVE-2026-84908: WPFunnels missing authorization in AJAX payment handler

Source: https://junglewise.ai/threats/cve-2026-84908-wpfunnels-missing-authorization-in-ajax-payment-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84908 · Severity: medium · CVSS 5.3 · Published 2026-09-09

WPFunnels is a WordPress plugin for managing sales funnels and checkout flows. The plugin's payment processing AJAX endpoint is accessible to unauthenticated users and fails to validate which products should be added to a cart, allowing attackers to manipulate product prices and bypass discount restrictions, resulting in direct revenue loss through unauthorized discounted transactions.

Technologies: [WPFunnels](https://junglewise.ai/threats/technologies/wpfunnels). Vendors: [WPFunnels](https://junglewise.ai/threats/vendors/wpfunnels).

## Quick answers

**Is CVE-2026-84908 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84908 being exploited in the wild.

**How severe is CVE-2026-84908?** Medium severity, with a CVSS score of 5.3, published 9 September 2026.

**Which products and versions are affected?** WPFunnels up to and including 3.12.13.

**Is there a fix for CVE-2026-84908?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84908 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84908?** Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization flaw in the wpfnl_load_payment AJAX action (class-wpfnl-offer.php). The action is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users, and the underlying add_offer_product_to_cart() function lacks nonce verification, capability checks, and product validation. An unauthenticated attacker can supply arbitrary product_id and step_id parameters to add any WooCommerce product to a cart at any discounted price configured on any funnel step. No authentication or authorization is required; the attack is network-reachable via a standard AJAX POST request. The attacker achieves direct price manipulation and checkout fraud.

## Affected products

- WPFunnels WPFunnels up to and including 3.12.13

## Timeline

- 2026-09-09: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php)
- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php)

## Related threats

- [WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler](https://junglewise.ai/threats/cve-2026-79632-wpfunnels-plugin-unauthenticated-arbitrary-email-sending-in-opt)
- [WPFunnels WordPress plugin information disclosure via web-accessible logs](https://junglewise.ai/threats/cve-2026-79631-wpfunnels-wordpress-plugin-information-disclosure-via-web)
- [WPFunnels checkout order bump product substitution allowing price manipulation](https://junglewise.ai/threats/cve-2026-79630-wpfunnels-checkout-order-bump-product-substitution-allowing-price)
- [WPFunnels WordPress plugin unauthenticated user registration bypass](https://junglewise.ai/threats/cve-2025-15691-wpfunnels-wordpress-plugin-unauthenticated-user-registration)
- [WPFunnels broken access control vulnerability](https://junglewise.ai/threats/cve-2026-84754-wpfunnels-broken-access-control-vulnerability)