Your WooCommerce checkout is public. That’s the point, but it also means a flaw there doesn’t necessarily require a stolen password. Two recent advisories cover CartFlows and FunnelKit Automations, with different risks and different evidence about exploitation.
The versions to act on: CartFlows 3.3.0 or older, and FunnelKit Automations 3.8.6.1 or older. Update both to the newest available release. CartFlows was fixed in 3.3.1; FunnelKit Automations was fixed in 3.8.6.2.
I’m Andrei, and I run a WordPress maintenance and security agency. My advice here is straightforward: check your installed plugins today, even if you don’t remember using either name.
CartFlows: a stranger can trigger installed shortcodes
WPSec published advisory WPSEC-2026-2256 on 3 November 2026 for CartFlows - Funnel Builder & Checkout Plugin for WooCommerce, plugin slug cartflows. Every version up to and including 3.3.0 is affected. Version 3.3.1, released on 2 November, contains the fix.
The flaw is unauthenticated arbitrary shortcode execution, classified as CWE-94. That’s a mouthful. In plain English, someone without an account could make your site process a shortcode they supplied.
Shortcodes are bracketed instructions such as [example_form]. A plugin registers the instruction, and WordPress replaces it with whatever that plugin provides: perhaps a form, account information or another piece of content.
CartFlows placed customer-controlled data into the markup of its checkout, optin and order details shortcodes without neutralizing shortcode brackets. That included checkout fields pre-filled from URL query parameters, where any parameter name was accepted, WooCommerce notices such as an unknown coupon code message, and order details.
The catch was a second pass. When CartFlows blocks or page builder widgets rendered those shortcodes, the resulting output was processed for shortcodes again. Text supplied by a visitor could become an instruction.
A crafted link or coupon code could provide the input. No login needed.
What the CartFlows flaw does and doesn’t mean
A stranger could trigger any shortcode installed on the site, including shortcodes registered by other plugins. If one exposes private information or displays a form that shouldn’t be reachable there, that matters.
But this isn’t the same as saying every affected shop allows arbitrary PHP execution or a complete takeover. The impact depends on what your installed shortcodes actually do. The advisory’s CVSS vector rates confidentiality, integrity and availability impacts as low.
WPSec reported no exploitation in its advisory. That’s the stated position, not proof that nobody has tried it.
For checkout design, I prefer fewer moving parts over another clever funnel feature. Our WooCommerce e-shop development work includes thinking about which checkout features a shop actually needs, rather than keeping every campaign experiment running forever.
FunnelKit Automations: a different, potentially larger risk
This advisory concerns FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce, slug wp-marketing-automations. It has 20,000+ active installs. Versions through 3.8.6.1 are affected by CVE-2026-39738; 3.8.6.2 is the patched version.
The flaw is unauthenticated PHP object injection through deserialization of untrusted data. Think of deserialization as rebuilding structured data into something PHP can use. Here, untrusted input can enter that process.
The potential damage depends partly on other code installed alongside it. Wordfence says there’s no known POP chain in the plugin itself. A POP chain is a sequence of existing code that can turn object injection into harmful actions; if another plugin or theme provides one, an attacker could delete files, read sensitive data or run code.
That’s a meaningful condition. Don’t drop it from the story.
Patchstack and Wordfence published the issue on 30 October 2026. Patchstack assigns CVSS 9.8, while Wordfence assigns 8.1 and credits researcher Shon Bida. That dependency helps explain the differing scores.
Exploitation is reported, not confirmed mass attacks
CIRCL Vulnerability-Lookup lists exploitation as reported since 2 November 2026, and Patchstack marks the flaw as known exploited. The careful wording is reported as exploited. There’s no basis here for claiming confirmed mass attacks.
CISA hasn’t added it to its KEV catalog, and no public exploit code is tracked in the cited information. Neither point is a reason to postpone updating.
One tracker notes that the 3.8.6.2 changelog doesn’t mention the CVE. However, Patchstack and Wordfence both identify that release as patched. Install the newest available version, not just 3.8.6.2.
Do this today, then test the checkout
- Check
Plugins > Installed Plugins. Look for CartFlows and FunnelKit Automations. CartFlows Pro uses the free CartFlows plugin too, so check its version. - Take a current backup, then update. Use the newest available releases. The fixed minimums are CartFlows 3.3.1 and FunnelKit Automations 3.8.6.2.
- Can’t update now? Deactivate until you can. For FunnelKit Automations especially, don’t leave an affected version active while waiting for a quieter week.
- Remove forgotten plugins. If a funnel plugin was installed for one campaign and is no longer used, deactivate and delete it.
- Clear the page cache and test. Place a test order through the funnel checkout, try a coupon, check the thank-you page renders and check the order emails.
Don’t rely on the ordinary shop checkout if customers actually buy through a separate funnel page. Test that route. It’s easy to remeber the main shop and miss the landing page linked from your ads.
If nobody owns this routine, arrange WordPress maintenance with explicit responsibility for updates and checkout testing. An updated plugin isn’t much comfort if buyers can’t complete an order afterward.
Check for compromise without guessing
For an affected FunnelKit Automations installation, check for:
- Administrator accounts you don’t recognise.
- Unexpected changes to plugin or theme files.
- New PHP files inside
wp-content/uploads.
These are warning signs, not automatic proof of this particular exploit. If something looks wrong, preserve logs and get it investigated. Our guide to signs your WordPress site has been hacked explains what else to inspect.
Checkout plugins sit where customers and bots can reach them without logging in. That’s why their update queue deserves attention. For the wider picture, read securing WordPress when you take payments on your online shop.
Today, start with the installed versions. Then run one order through the checkout your customers actually use.