{"metadata": {"vulnerability": "CVE-2026-107746", "count": 16, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-08T18:26:05.307Z", "date_only": false, "value": "2026-10-08T18:26:05.307Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107746", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T18:41:24Z", "date_only": false, "value": "2026-10-08T18:41:24.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107746", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T15:40:24Z", "date_only": false, "value": "2026-10-15T15:40:24.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107746", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:27:03.447Z", "date_only": false, "value": "2026-10-16T04:27:03.447Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107746", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:27:03.447Z", "date_only": false, "value": "2026-10-16T04:27:03.447Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107746", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T04:47:11.272Z", "date_only": false, "value": "2026-10-16T04:47:11.272179Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448771181926014", "record": "CVE-2026-107746", "field": "creation_timestamp", "uuid": "d2cd6da4-5282-4cdd-96bc-eced482a765f", "content": "CVE-2026-107746 FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII \u2014 including full name, street address, email address, and phone number \u2014 for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107746https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cvehttps://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip#wordpress #teamfunnelkit #FunnelKit\u2013FunnelBuilderPluginforWooCommerceCheckout#CVE_2026_107746#bot", "url": "https://infosec.exchange/users/cve/statuses/117448771181926014"}, {"timestamp": "2026-10-16T04:59:40.570Z", "date_only": false, "value": "2026-10-16T04:59:40.570620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxxs63bwkw2r", "record": "CVE-2026-107746", "field": "creation_timestamp", "uuid": "86e944f3-3a35-4a68-8b2c-5aa857a10ffb", "content": "FunnelKit, a WooCommerce plugin on 30,000+ stores, has a flaw that lets anyone with no login read the billing name, address, email and phone on any order.\n\nExposed only if your thank-you page shows FunnelKit order data.\n\nFix: update to 3.17.0. (CVE-2026-107746)", "url": "https://bsky.app/profile/suriq.io/post/3mxxs63bwkw2r"}, {"timestamp": "2026-10-16T05:17:28Z", "date_only": false, "value": "2026-10-16T05:17:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FJVP-GR2J-2XRC", "record": "GHSA-FJVP-GR2J-2XRC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:28.837Z", "date_only": false, "value": "2026-10-16T05:17:28.837", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107746", "record": "FKIE_CVE-2026-107746", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FJVP-GR2J-2XRC", "record": "GHSA-FJVP-GR2J-2XRC", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FJVP-GR2J-2XRC", "record": "GHSA-FJVP-GR2J-2XRC", "field": "modified"}, {"timestamp": "2026-10-16T15:49:31.146Z", "date_only": false, "value": "2026-10-16T15:49:31.146847Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107746", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T15:49:31.146Z", "date_only": false, "value": "2026-10-16T15:49:31.146847Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107746", "record": "FKIE_CVE-2026-107746", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:53:00.052Z", "date_only": false, "value": "2026-10-16T15:53:00.052Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107746", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:53:00.052Z", "date_only": false, "value": "2026-10-16T15:53:00.052Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107746", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:16:57.983Z", "date_only": false, "value": "2026-10-16T16:16:57.983", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107746", "record": "FKIE_CVE-2026-107746", "field": "lastModified"}]}