CVE-2026-79630

The WPFunnels WordPress plugin versions prior to 3.13.0 is vulnerable to an unauthenticated price manipulation flaw. The root cause is a failure to verify that a product requested through a checkout order bump matches the specific product the discount was configured for. This allows unauthenticat...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the CreateOrderFromCartAction::execute process. An attacker can bypass intended usage limits by performing concurrent checkouts, resulting in discounts being applied beyond the configured maximum without detection...