WordPress Plugin Vulnerabilities

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.2 - Unauthenticated Insecure Direct Object Reference

Description

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.1. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
wpfunnels
Fixed in 3.13.2

References

CVE
CVE-2026-97269
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/924d8186-63bd-4604-8262-a6481425bc7a

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Supakiad S.
Verified
No
WPVDB ID
811d3278-e56b-4a32-8fa7-ebfc90f5b883

Timeline

Publicly Published
2026-10-01 (about 22 days ago)
Added
2026-10-09 (about 15 days ago)
Last Updated
2026-10-09 (about 15 days ago)

Other

Published
Title
Published
2026-03-10
Title
Happy Addons for Elementor < 3.21.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
Published
2026-02-17
Title
Frontend User Notes < 2.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification
Published
2026-06-19
Title
License Manager for WooCommerce < 3.0.16 - Unauthenticated Insecure Direct Object Reference
Published
2026-07-21
Title
ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
Published
2025-08-22
Title
Accessibility Checker by Equalize Digital < 1.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference