An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable WordPress site running the FunnelKit plugin.
Affected component: FunnelKit – Funnel Builder Plugin for WooCommerce Checkout (plugin)
Fixed in: 3.17.0
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 19, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.17.0 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-107746