Executive brief
Funnel Builder for WooCommerce Checkout is a popular WordPress plugin used to optimize the checkout process for online stores. A security flaw allows unauthorized individuals to inject malicious code into the checkout page, which can be used to steal customer payment information, including credit card numbers and billing addresses. This vulnerability has been actively exploited in the wild to deploy payment skimmers on over 40,000 websites.
Technical details
A missing authorization vulnerability (CWE-862) exists in the AJAX controller of the Funnel Builder for WooCommerce Checkout plugin. The public checkout endpoint fails to validate user permissions or restrict which internal methods can be invoked, allowing an unauthenticated attacker to call methods that update the plugin's 'External Scripts' global setting. By injecting malicious JavaScript into this setting, attackers can execute arbitrary code in the browsers of all visitors on the checkout page. This has been observed in the wild being used to deploy Magecart-style payment skimmers. The issue is resolved in version 3.15.0.3, which implements proper capability checks and an allow-list for safe methods.
Affected products
- FunnelKit Funnel Builder for WooCommerce Checkout < 3.15.0.3
Timeline
- 2026-05-14: other: Active exploitation reported by Sansec
- 2026-05-19: advisory: NVD and VulnCheck advisories published
- 2026-05-19: patched: Fix released in version 3.15.0.3
References
- https://plugins.trac.wordpress.org/changeset/3530797/funnel-builder/tags/3.15.0.3/modules/checkouts/includes/class-wfacp-ajax-controller.php
- https://sansec.io/research/funnelkit-woocommerce-vulnerability-exploited
- https://www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax