CyberRota Analysis
AI-GeneratedThe WPFunnels plugin for WordPress versions up to 3.12.13 is vulnerable due to a lack of proper authorization checks, allowing unauthenticated users to exploit the 'wpfnl_load_payment' AJAX action. This vulnerability enables attackers to add arbitrary WooCommerce products to a cart at manipulated prices, potentially leading to significant revenue loss for affected e-commerce sites. WordPress site administrators using this plugin should prioritize updating to mitigate the risk of exploitation.
Original NVD Description
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.