---
id: CVE-2026-84908
title: >-
  The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in
  versions up to, and including, 3.12.13
summary: >-
  The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in
  versions up to, and including, 3.12.13. This is due to the plugin registering
  the 'wpfnl_load_payment' AJAX action for both authenticated and
  unauthenticated (w…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: getwpfunnels
product: WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
affected:
  - >-
    wpfunnels_funnel_builder_for_woocommerce_with_checkout_one_click_upsell <=
    3.12.13
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T15:33:34.467'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84908'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L166
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L213
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L71
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L166
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L213
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L71
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3675200%40wpfunnels&new=3675200%40wpfunnels
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/5a24d442-56f9-4f6d-bff6-0eb354249895?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T13:07:55.317127Z'
ingestedAt: '2026-09-09T06:01:00.005Z'
epss: 0.00423
epssPercentile: 0.33863
---

## Overview

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.