Threats Tagged 'cve-2026-84908'
View all threats tagged with 'cve-2026-84908'. Filter and sort to focus on specific types of threats.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-84908'
Click on any threat for detailed analysis and mitigation recommendations
CVE Database V5 · 09/09/2026, 05:31:04 UTC 0 The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout. Join the discussion | CVE Database V5 | 09/09/2026, 05:31:04 UTC Added: 09/09/2026, 05:37:41 UTC |
Showing 1 to 1 of 1 result
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console → Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.