CVE-2026-79630 — WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

CVE-2026-79630

WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution PUBLISHED

Description (CNA)

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

Affected (CNA)

Vendor / product	Versions
Unknown / WPFunnels	affected 0 before 3.13.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fb49c59a-f79f-495c-a23e-0e1629cfa53e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.