WordPress Plugin Vulnerabilities

WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

Description

The plugin does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

Proof of Concept

Affects Plugins

Plugin icon
wpfunnels
Fixed in 3.13.0

References

CVE
CVE-2026-79630

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Aditya Gurav
Submitter
Aditya Gurav
Verified
Yes
WPVDB ID
fb49c59a-f79f-495c-a23e-0e1629cfa53e

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2026-08-05
Title
CubeWP Framework <= 1.1.31 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
Published
2024-11-20
Title
Button Block – Get fully customizable & multi-functional buttons < 1.1.5 - Authenticated (Contributor+) Post Disclosure
Published
2026-05-19
Title
Oliver POS < 4.5.4 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Published
2025-11-12
Title
Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR
Published
2023-08-30
Title
Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode