CVE-2026-107746: CWE-862 Missing Authorization in teamfunnelkit FunnelKit – Funnel Builder Plugin for WooCommerce Checkout

CVE-2026-107746 is an authorization bypass vulnerability (CWE-862) in the FunnelKit – Funnel Builder Plugin for WooCommerce Checkout for WordPress. The plugin fails to properly verify user authorization before disclosing sensitive billing information associated with WooCommerce orders. Attackers can exploit this by enumerating sequential order IDs on sites that have a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode, thereby accessing full billing PII without authentication. This affects all versions up to and including 3.16.0.6.

An unauthenticated attacker can access sensitive billing information including full name, street address, email address, and phone number for any WooCommerce order on affected sites. This leads to a confidentiality breach of customer data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling or restricting access to FunnelKit thank-you pages that render the vulnerable shortcodes or implement additional access controls to prevent unauthorized access to order information.