Description

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T07:17:09.817Z",
  "pubdate": "2026-09-04T07:17:09.817Z",
  "executiveSummary": "The WPFunnels WordPress plugin prior to version 3.13.0 contains an improper access control vulnerability within its checkout order bump mechanism. This security flaw allows unauthenticated attackers to manipulate the checkout process, specifically targeting the price calculation logic associated with order bumps.\nThe vulnerability stems from a failure to cryptographically or logically verify that the product added to the cart via an order bump matches the product configuration for which a specific discount was intended. By intercepting or crafting requests, an attacker can substitute the intended discounted item with any other high-value product available in the store while maintaining the discounted price point.\nThis represents a significant risk to e-commerce integrity, enabling unauthorized price manipulation and potential financial loss. The flaw does not require authentication, making it accessible to any user interacting with the checkout flow. Exploitation requires no advanced privileges, only the ability to interact with the plugin's API endpoints or checkout requests. Organizations utilizing versions of WPFunnels prior to 3.13.0 are exposed to direct unauthorized financial transactions and manipulation of order totals.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure validation process within the WPFunnels order bump implementation. When a user triggers an order bump during the checkout process, the plugin backend is responsible for verifying that the discount parameters applied to the total order are legitimate. Specifically, the logic fails to enforce an authoritative link between the discounted item ID provided in the order bump request and the original product configuration defined in the plugin's administrative dashboard.\nIn a secure implementation, the server should treat the order bump request as an untrusted input, validating the requested product ID against a server-side session or a signed configuration object. In the vulnerable versions, the application trustfully processes the 'product_id' parameter sent from the client-side checkout request without performing a secondary server-side cross-reference check.\nThe attack flow proceeds as follows: First, the attacker initiates a standard checkout process for an inexpensive item. During the order bump phase, the attacker intercepts the HTTP request sent to the WPFunnels endpoint responsible for adding the order bump to the cart. By modifying the product ID in the payload to correspond with a high-value item within the store, the attacker exploits the plugin's lack of validation. Because the server identifies that a discount is currently active for 'an' order bump, it incorrectly applies the pre-configured discount percentage or flat rate to the attacker-supplied high-value item ID.\nThe plugin then calculates the new total for the checkout session, incorporating the high-value product at the lower price point intended for the original, cheaper order bump product. The checkout proceeds through the payment gateway with this manipulated total. The server-side logic fails to re-verify the product identity before the transaction is finalized, allowing the attacker to receive premium items for a fraction of their actual cost.\nThis vulnerability is classified as an improper authorization and input validation issue. It affects versions prior to 3.13.0 and is accessible over the network without any authentication or elevated user privileges. The post-exploitation impact allows for severe financial discrepancies, inventory loss, and the bypass of business logic governing pricing structures. Because the order bump mechanism is a client-initiated action, the plugin essentially provides an oracle that accepts user-supplied parameters to define the state of the checkout cart, violating the integrity of the transaction."
}