CVE-2026-79630CWE-639

CVE-2026-79630

Medium · published September 4, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 21.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-04T11:17Z
References (1)
https://wpscan.com/vulnerability/fb49c59a-f79f-495c-a23e-0e1629cfa53e/ · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 04 SEP 06:00Z
    WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
    cvelistv5