CVE-2026-109991

The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script on every matching page response. Exploitation occurs even when WooCommerce itself rejects the order-pay page request, because the plugin's wp_localize_script call runs independently of WooCommerce's own order-key validation on the same request.

CWE: CWE-639 ／ 公開 2026年11月7日 ／ 最終更新 2026年11月7日

FunnelKit Payment Gateway for Stripe WooCommerce を 1.16.0 以降に更新してください。これで本脆弱性は解消します。

FunnelKit Payment Gateway for Stripe WooCommerce の他の脆弱性を見る →