5.3
Medium
CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump…
Description
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPFunnels 3.13 | earliest → < 3.13.0 | 3.13.0 |
Other CVEs of WPFunnels
The 4 CVEs of WPFunnels →
CVE-2026-79631
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable…
5.3
Medium
CVE-2026-79632
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in…
5.3
Medium
CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before…
5.3
Medium