CVE-2026-57635: CSRF Vulnerability in FunnelKit Payment Gateway for Stripe WooCommerce

Technical summary

This vulnerability is a classic CSRF flaw (CWE-352) affecting the FunnelKit Payment Gateway for Stripe WooCommerce plugin up to version 1.14.0.3. The plugin fails to validate anti-CSRF tokens on state-changing requests, allowing an unauthenticated threat actor to craft cross-origin requests that execute with the privileges of a logged-in store administrator or customer. The attack requires user interaction (visiting a malicious site), but no special privileges or complex exploitation conditions. The CVSS 3.1 score of 6.5 reflects the integrity impact (high) balanced against the requirement for user interaction and lack of confidentiality or availability impact.

Business impact

A successful CSRF attack against a WooCommerce store could allow unauthorized modification of Stripe payment configuration, creation of fake refunds, or alteration of product pricing and checkout flows. Store administrators are the primary target, but customer-facing CSRF attacks could also redirect payments or modify cart behavior. The reputational and financial impact depends on the scope of changes an attacker can trigger, but the potential for payment fraud makes this a material risk, especially for e-commerce operations handling sensitive transactions.

Affected systems

FunnelKit Payment Gateway for Stripe WooCommerce plugin versions 1.14.0.3 and earlier are affected. This includes any WooCommerce installation with the vulnerable plugin active. The vulnerability does not affect the Stripe API itself or other payment gateway plugins, but any site using this specific FunnelKit plugin for Stripe integration is at risk until patched.

Exploitability

The vulnerability is moderately easy to exploit. An attacker needs only to craft an HTML page or email containing a hidden request that targets the vulnerable WooCommerce site, then distribute it to store staff or customers. The victim's browser automatically includes session cookies when visiting the attacker's site, allowing the malicious request to execute with the victim's authority. No special tools, credentials, or advanced technical knowledge are required beyond basic web development. However, the attack does depend on the victim clicking a link or visiting a page—passive network exposure alone is insufficient.

Remediation

Immediately update FunnelKit Payment Gateway for Stripe to a patched version above 1.14.0.3. Verify the latest available version through the WooCommerce plugin repository or the vendor's official website. After patching, review Stripe payment settings, recent refunds, and transaction logs for any suspicious activity. As a temporary mitigation, restrict admin panel access to trusted IP addresses and educate store staff about the risks of clicking suspicious links while logged in.

Patch guidance

Navigate to WooCommerce Plugins in the WordPress admin dashboard, locate FunnelKit Payment Gateway for Stripe, and upgrade to the latest available version. Verify against the vendor's advisory that the installed version exceeds 1.14.0.3. Test payment processing and Stripe integration functionality in a staging environment before deploying to production. After updating, confirm the plugin is activated and that no residual configuration conflicts exist with other payment or security plugins.

Detection guidance

Monitor WooCommerce access logs and Stripe webhook logs for unexpected API calls or payment configuration changes from unfamiliar IP addresses or user agents. Use WordPress security plugins to audit admin actions and flag unauthorized modifications to payment settings. Set alerts for failed CSRF token validations if the plugin or WAF logs such events. Track changes to Stripe API credentials, webhook endpoints, and payment settings in version control or audit logs. On Stripe's dashboard, review recent API activity and connected integrations for anomalies.

Why prioritize this

Although not yet on CISA's KEV catalog, this vulnerability merits prompt prioritization because it directly impacts payment processing—a critical business function—and requires no authentication from the attacker. Any WooCommerce store using FunnelKit for Stripe integration is exposed to payment fraud and configuration tampering. The low barrier to exploitation and high business impact outweigh the moderate CVSS score.

Risk score, explained

CVSS 3.1 base score of 6.5 (MEDIUM) reflects high integrity impact balanced against required user interaction and no confidentiality or availability loss. The vector AV:N/AC:L/PR:N/UI:R/S:U indicates the attack is network-based, low-complexity, requires no privileges, but does need the user to interact (click a link or visit a malicious page). For payment-critical e-commerce environments, the real-world risk is higher than the base score suggests, warranting elevation to HIGH priority in organizational risk frameworks.

Frequently asked questions