CVE-2026-109991

Name of the Vulnerable Software and Affected Versions FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress versions prior to 1.16.0

Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can read full billing personally identifiable information (PII), such as name, email address, phone number, and street address, by enumerating sequential order IDs. This occurs because the data is emitted into the inline fkwcs data JavaScript object via wp localize script on every matching page response. The issue persists even if WooCommerce rejects the request, as the plugin's script call runs independently of the standard order-key validation. The affected endpoint is '/checkout/order-pay//' using the order-pay parameter.

Recommendations Update to version 1.16.0.