CVE-2026-81649: CWE-863 Incorrect Authorization in Fundiin cho WooCommerce
Description
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
CVSS v3.1
Score 9.1critical
Affected software
Fundiin cho WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-81649 describes an incorrect authorization vulnerability (CWE-863) in the Fundiin cho WooCommerce plugin through version 3.4.0. The plugin uses a credential identical across all installations for several REST API endpoints, failing to properly restrict access. This enables unauthenticated attackers to disclose sensitive payment and order information, alter payment gateway configurations to redirect funds, and mark unpaid orders as paid. Additionally, the missing authorization allows injection of arbitrary scripts stored in a field that is output unescaped on the classic checkout, resulting in unauthenticated stored XSS on stores not using the block-based checkout.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized disclosure of payment credentials and customer order data, financial fraud by redirecting payments, unauthorized order status changes, and cross-site scripting attacks that could compromise user sessions or site integrity. These impacts affect both the confidentiality and integrity of the affected WooCommerce stores.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API routes of the Fundiin cho WooCommerce plugin and consider disabling the plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-27T09:27:23.244Z
- State
- PUBLISHED
Threat ID: 6acb2ddf2cdf04f656b78cf3
Added to database: 10/11/2026, 06:34:07 UTC
Last enriched: 10/11/2026, 07:04:10 UTC
Last updated: 10/11/2026, 21:33:38 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.