CVE-2026-81649

Summary

The Fundiin WooCommerce plugin has a critical authorization flaw in its REST API that allows unauthenticated attackers to access sensitive payment data, modify payment configurations, and trigger stored XSS vulnerabilities on classic checkout pages.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability relies on hardcoded credentials present in every installation that can be used to access protected REST endpoints without authentication.

Blast radius

The impact could be severe across many WooCommerce stores, potentially leading to unauthorized fund transfers, data breaches, and client-side attacks through stored XSS on checkout pages.

Detection

Monitor for unusual access patterns to WooCommerce REST API endpoints, particularly those related to payment processing and order management, with no authentication headers present in requests.

Prioritized remediation

Upgrade to version 3.4.1 or later which fixes the authorization issue in the REST API endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.