Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
FunnelKit Payment Gateway for Stripe WooCommerce - Security Vulnerability (CVE-2026-109991)
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay//)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script…
PLUGIN
FunnelKit Payment Gateway for Stripe WooCommerce
CVE-2026-109991
Risk Score
Threat Entry
Updated 2026-06-29
FunnelKit Payment Gateway for Stripe WooCommerce - Cross-Site Request Forgery (CSRF) (CVE-2026-57635)
Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce
PLUGIN
FunnelKit Payment Gateway for Stripe WooCommerce
CVE-2026-57635
Risk Score