Introduction
Over 40,000 WooCommerce stores running the FunnelKit Funnel Builder plugin are exposed to a missing-authorization flaw that lets unauthenticated attackers inject JavaScript payment skimmers directly into checkout pages. Sansec researchers have confirmed active exploitation. Threat actors are deploying Magecart-style skimmers that harvest credit card numbers, CVVs, and billing addresses from shoppers.
FunnelKit's Funnel Builder is a WordPress plugin that gives WooCommerce merchants checkout page customization, sales funnels, and upsell workflows. It has more than 40,000 active installations. Because the plugin is built into the checkout flow, a vulnerability in it has a direct path to payment data.
Technical Information
The vulnerability is in the public AJAX endpoint handled by class-wfacp-ajax-controller.php. In versions prior to 3.15.0.3, this controller accepts incoming requests and dispatches them to internal methods based on a caller-supplied parameter. The flaw has two parts. The endpoint performs no authorization or capability check on the caller, and it does not restrict which internal methods a request can invoke.
As a result, any unauthenticated user can craft a request that reaches internal methods that were never meant to be public. One of those methods writes data into the plugin's global settings store. By calling it, an attacker can write arbitrary content into the "External Scripts" setting. The plugin automatically renders the contents of that field as HTML and JavaScript on every checkout page it generates.
Attack Flow
The exploitation chain observed in the wild has five stages:
-
Initial injection: The attacker sends an unauthenticated AJAX request to the Funnel Builder's public checkout endpoint. The request names the internal method that writes to global settings and carries a malicious JavaScript payload as the value to write into the External Scripts field.
-
Persistence via global settings: Because the External Scripts setting is a global configuration value, the injected code persists across page loads and affects every checkout page the plugin renders. In effect, this is stored cross-site scripting, reached through an authorization bypass instead of a traditional input-validation failure.
-
Disguised payload delivery: The injected script is made to look like a legitimate Google Tag Manager snippet. On page load, it decodes a base64-encoded string into a URL on the attacker-controlled domain
analytics-reports[.]com, then fetches an external JavaScript file from that domain. -
WebSocket-based C2: The loaded script opens a WebSocket connection to
wss://protect-wss[.]com/ws. The command-and-control server replies with a payment skimmer built for the structure of the target storefront's checkout form. -
Data exfiltration: The skimmer intercepts credit card numbers, CVVs, and billing addresses as shoppers complete their purchases, and sends the data back to the attacker's infrastructure.
Patch Details
The changeset at revision 3530797 in the WordPress Plugin Repository shows how the fix works. Version 3.15.0.3 adds capability checks to the endpoint and limits callable methods to a strict allowlist of safe operations. The patch also adds nonce verification, so the endpoint processes a request only when it carries a valid wfacp_nonce parameter.
CVSS Score Discrepancy
The NVD scores this vulnerability 7.5, and VulnCheck scores it 8.7. The NVD score likely reflects the technical characteristics of the authorization bypass in isolation. VulnCheck's higher score may account for the downstream impact: stored script injection that reaches every checkout visitor, and confirmed active exploitation that enables financial data theft.
Affected Systems and Versions
All versions of the Funnel Builder for WooCommerce Checkout plugin prior to version 3.15.0.3 are affected. The vulnerability is classified under CWE-862 (Missing Authorization).
An unauthenticated remote attacker can exploit any WordPress site that runs a vulnerable version of the plugin with the checkout module active. The attack needs no special configuration beyond the plugin being installed and active.
Vendor Security History
FunnelKit has a documented history of authorization and input-validation issues. In September 2022, researchers disclosed vulnerabilities in WooFunnels version 2.3.0, including session token URL hijacking and stored cross-site scripting flaws that could be used to target authenticated users. The reappearance of an authorization bypass in the same product line suggests that the plugin's AJAX endpoint architecture would benefit from a broader security audit, particularly of how internal methods are exposed and protected.
References
- NVD Entry for CVE-2026-47100
- VulnCheck Advisory: Funnel Builder for WooCommerce Checkout Missing Authorization via AJAX
- Sansec Research: Critical FunnelKit Vulnerability Threatens 40,000+ WooCommerce Checkouts
- WordPress Plugin Repository Changeset 3530797
- The Hacker News: Funnel Builder Flaw Under Active Exploitation
