Chargebacks & Fraud

Four WooCommerce Payment Plugins Patch Flaws That Leak Billing Data or Mark Orders Paid

Wordfence and CVE records published in early November 2026 describe order-pay data leaks in FunnelKit Stripe and Paystack, a critical file-upload flaw in payever through 4.8.0, and unverified paid notices in Paymentfor before 1.0.6.

E-commerce 4 Internet Marketers Editorial

At a general-store counter, an older shopkeeper in an apron holds a slip of paper while a younger man in a navy coat writes in a notebook beside a brass cash register, as if the two of them are checking whether a sale was truly paid.

Four WooCommerce payment plugins published fixes this fall for flaws that either expose customer billing details on the pay-for-order page or let an outsider change whether an order looks paid. Two of the information leaks were assigned CVE records in early November 2026. A third, in payever’s gateway, is a file-upload bug that vulnerability databases score as critical. The fourth, in Paymentfor Gateway for WooCommerce, let forged payment notices mark orders complete.

None of these reports describes a break in WooCommerce core. Each one lives in a gateway plugin that runs beside checkout, on the order-pay URL, or on a payment-notification callback. That is the part of a store that already holds names, addresses, phone numbers and shipping decisions, which is also the data fraud desks use to talk a merchant into a refund or a replacement shipment.

FunnelKit Stripe leaves billing profiles in page scripts

Wordfence published an advisory on November 6, 2026, for FunnelKit Payment Gateway for Stripe WooCommerce, tracked as CVE-2026-109991. Versions through 1.15.0.2 fail to validate the order identifier on the order-pay path, a page WooCommerce serves at a URL such as /checkout/order-pay/123/. An unauthenticated visitor who walks sequential order IDs can read the billing name, email address, phone number and full street address of any store order.

Wordfence said the plugin writes that profile into an inline JavaScript object named fkwcs_data, using WordPress’s wp_localize_script function, even when WooCommerce itself rejects the order-pay request because the secret order key is missing or wrong. The advisory scores the issue 7.5 (High). The public write-ups do not say that card numbers or Stripe secret keys appear in that object. FunnelKit’s 1.16.0 changelog includes “Hardened code on order pay pages,” and Wordfence lists 1.16.0 as the patched release. Rapid7 and other CVE mirrors repeat the same affected-version range and description.

Paystack’s leak depends on a metadata setting

A similar order-pay problem affects the Paystack WooCommerce Payment Gateway through version 5.8.5, published by Wordfence on November 6 as CVE-2026-93370 and scored 5.3 (Medium). An unauthenticated attacker can extract billing name, email, phone, billing and shipping addresses, and the list of purchased products from HTML that the plugin embeds with wp_localize_script, again by enumerating order IDs. Wordfence said this works only when the merchant has turned on the optional custom metadata feature in the Paystack gateway settings.

Paystack’s own GitHub project released version 5.8.6 on October 31, 2026, with the note “Validate order key before displaying Paystack params on the pay for order page.” That is the patched version Wordfence recommends. Stores that never enabled custom metadata are outside the exploit path Wordfence described, but updating still closes the gap if someone turns the setting on later.

payever’s unauthenticated callbacks can write files

CVE-2026-93754 covers payever’s WooCommerce Gateway through 4.8.0. Patchstack listed the issue on November 6, 2026, and Tenable’s CVE record, drawing on MITRE and the National Vulnerability Database, describes an unauthenticated file upload that can lead to remote code execution. According to that record, three WooCommerce API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription and payever_synchronization_incoming) were registered without authentication, a capability check or a nonce. A routine named upload_image() then wrote a remotely fetched file into the public uploads directory using a file name the requester could influence, before the plugin checked the file type.

Tenable scores the issue 9.8 (Critical). The same record notes that one part of a longer attack chain depends on the plugin calling payever’s own token-validation service, and that a separate identity-overwrite weakness is described as independently exploitable. WordPress.org now lists the plugin at version 4.9.0, which Patchstack and Wordfence name as the fix. A store that cannot update immediately should deactivate the plugin and inspect wp-content/uploads for unexpected PHP files, then treat the site as potentially compromised if any appear. That kind of review sits alongside the file-integrity checks worth running after any payment-plugin incident.

Paymentfor accepted unverified paid notices

Paymentfor Gateway for WooCommerce, a Japan-focused plugin for Payment for, Inc., had a different failure. Wordfence lists versions before 1.0.6 as open to unauthenticated order-status manipulation. Vulnerability databases track that report as CVE-2026-94360. The vendor’s own 1.0.6 changelog, dated October 6, 2026, says card payment return and notification requests could mark an order as paid without verifying the payment. The update limits status changes to payment-completion notices whose source, order and amount have been checked, and it applies the same verification to the card thank-you page, PayPay payments and convenience-store notifications. The developers thanked Enrico Marcolini, Claudio Marchesini, Dottor Marc and Naoki Kawahigashi for reporting the issue through WPScan.

A forged “paid” flag is especially costly for a store that ships restricted goods as soon as WooCommerce flips the status. Merchants using this gateway should update to 1.0.6 or later and compare every order marked paid against Payment for, Inc.’s own merchant records before more inventory goes out.

Why the order-pay page and the callback URL matter

WooCommerce’s pay-for-order page is supposed to be reachable only with a secret order key, not by guessing the next invoice number. Two of these plugins still printed customer records into the page when that key was missing. Payment notification URLs are supposed to accept news only from the processor, with a signature or a server-to-server check. Paymentfor’s changelog describes a case where that check was missing. Gateway plugins also register extra WooCommerce API routes, and payever’s flaw shows what happens when those routes write files without proving who called them.

Owners should inventory every installed payment plugin, not only the one that processes most orders, and compare the installed version with the patched releases above: FunnelKit Stripe 1.16.0, Paystack 5.8.6, payever 4.9.0 and Paymentfor 1.0.6. After updating, they should purge page caches so an old fkwcs_data payload is not still being served, and they should look through web logs for bursts of requests to /checkout/order-pay/ that walk sequential IDs. The hardening steps that keep checkout templates and uploads under review remain useful after the patches, because a billing-data leak or a false paid status can sit unnoticed until a chargeback or a missing shipment brings it up.

Taken together, the four fixes are a reminder that a store can run a current copy of WooCommerce and still expose checkout data through the plugin that talks to the card network. The order-pay URL and the payment callback are not back-office details. They are public doors that need the same version check as the rest of the cart, and the patched releases are the versions that close the doors these advisories described.

Sources