EUVD-2026-119160

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay WP query var from /checkout/order-pay//' parameter due to missing validation on a user controlled key. This...

CVE-2026-109991

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress (versions <= 1.15.0.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists due to missing validation on the order-pay URL path parameter (e.g., /checkout/order-pay//). Unauthenticated attackers...