The Upsell Funnel Builder for WooCommerce plugin has been found to allow unauthenticated order manipulation in all versions up to 3.0.0. By tampering with the additional product ID and discount value before they are processed in the add_offer_in_cart function, an attacker can arbitrarily change the product associated with any order bump and the discount applied to it. This flaw enables unauthorized modification of cart contents and pricing, which can lead to financial loss by altering purchase totals or providing free or discounted goods.

The vulnerability affects the WPSWings Upsell Funnel Builder for WooCommerce plugin for WordPress in all releases up to and including version 3.0.0. Any site running these versions of the plugin is at risk.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation. Since the vulnerability is not listed in the CISA KEV catalog, it currently has no known widespread exploitation. The likely attack vector is unauthenticated remote access through the public checkout flow, where an attacker can send crafted requests to the plugin's add_offer_in_cart endpoint. If the attacker succeeds, they can set arbitrary product IDs and discount values for order bump items, potentially altering order totals and revenue.