Is CVE-2026-47100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47100 being exploited in the wild.

How severe is CVE-2026-47100?

High severity, with a CVSS score of 7.5, published 19 May 2026.

Is there a fix for CVE-2026-47100?

A patch was published on 2026-05-19: Fix released in version 3.15.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47100 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47100?

Check whether you run FunnelKit Funnel Builder for WooCommerce Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47100: FunnelKit Funnel Builder for WooCommerce missing authorization in AJAX endpoint

CVE-2026-47100 · Severity: high · CVSS 7.5 · Published 2026-05-19

Funnel Builder for WooCommerce Checkout is a popular WordPress plugin used to optimize the checkout process for online stores. A security flaw allows unauthorized individuals to inject malicious code into the checkout page, which can be used to steal customer payment information, including credit card numbers and billing addresses. This vulnerability has been actively exploited in the wild to deploy payment skimmers on over 40,000 websites.

Technologies: FunnelKit Funnel Builder for WooCommerce Checkout. Vendors: FunnelKit.

Quick answers

Is CVE-2026-47100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47100 being exploited in the wild.
How severe is CVE-2026-47100?: High severity, with a CVSS score of 7.5, published 19 May 2026.
Which products and versions are affected?: FunnelKit Funnel Builder for WooCommerce Checkout < 3.15.0.3.
Is there a fix for CVE-2026-47100?: A patch was published on 2026-05-19: Fix released in version 3.15.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47100 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47100?: Check whether you run FunnelKit Funnel Builder for WooCommerce Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the AJAX controller of the Funnel Builder for WooCommerce Checkout plugin. The public checkout endpoint fails to validate user permissions or restrict which internal methods can be invoked, allowing an unauthenticated attacker to call methods that update the plugin's 'External Scripts' global setting. By injecting malicious JavaScript into this setting, attackers can execute arbitrary code in the browsers of all visitors on the checkout page. This has been observed in the wild being used to deploy Magecart-style payment skimmers. The issue is resolved in version 3.15.0.3, which implements proper capability checks and an allow-list for safe methods.

Affected products

FunnelKit Funnel Builder for WooCommerce Checkout < 3.15.0.3

Timeline

2026-05-14: other: Active exploitation reported by Sansec
2026-05-19: advisory: NVD and VulnCheck advisories published
2026-05-19: patched: Fix released in version 3.15.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.