CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109991
HIGHCVSS 7.5NVD feed
Published 7 November 2026 · tracked since 8 November 2026
Description
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missing validation on a user controlled key. T
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124318 HIGH 7.2
- CVE-2026-122041 CRITICAL 9.1
- CVE-2026-120841 HIGH 8.8
- CVE-2026-120839 HIGH 8.8
- CVE-2026-119156 HIGH 7.2
- CVE-2026-93766 HIGH 7.2
- CVE-2026-93755 HIGH 7.2
- CVE-2026-93429 HIGH 7.2
- CVE-2026-123418 HIGH 7.2
- CVE-2026-122231 HIGH 7.2