Loading story…
A critical vulnerability in Funnel Builder by FunnelKit, a WooCommerce checkout and upsell plugin used by more than 40,000 stores, has been actively exploited to inject malicious JavaScript into checkout pages. The flaw affects all versions before 3.15.0.3 and stems from a public checkout endpoint that allowed unauthenticated attackers to modify the plugin’s global settings, including the External Scripts option, without proper capability checks.
Attackers used the weakness to plant fake Google Tag Manager or analytics-style code that loaded a payment skimmer and stole card numbers, CVVs, billing addresses, and other customer data during checkout. Sansec said one observed attack chain fetched code from analytics-reports[.]com and opened a WebSocket connection to protect-wss[.]com to deliver a store-specific skimmer. FunnelKit released version 3.15.0.3 to restrict the endpoint to safe methods and add authorization checks, and defenders have been urged to update immediately and review the plugin’s External Scripts configuration for unauthorized entries.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
FunnelKit released version 3.15.0.3 to address the flaw by adding capability checks and restricting the vulnerable endpoint to an allow-list of safe methods. The vendor also acknowledged that attackers had been able to inject scripts through the plugin.
Sansec reported that the Funnel Builder vulnerability was being actively exploited and described one observed attack chain in which a loader fetched code from analytics-reports[.]com and opened a WebSocket to protect-wss[.]com to retrieve a store-specific skimmer. The firm said the issue affected all versions before 3.15.0.3 and threatened more than 40,000 WooCommerce stores.
Attackers abused an unauthenticated public checkout endpoint in Funnel Builder by FunnelKit to modify the plugin’s global settings and insert malicious JavaScript into WooCommerce checkout pages. The injected code masqueraded as Google Tag Manager or analytics scripts and stole payment card data, CVVs, billing addresses, and other customer information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcesansec.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 16, 2026
A critical authentication bypass vulnerability, tracked as **`CVE-2026-8457`**, affects the **WooCommerce - Social Login** WordPress plugin by WPWeb in all versions through **`2.8.7`**. The flaw allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by forging an Apple **`id_token`** JWT with a victim's email address. Researchers said the plugin's Apple login handler decodes the token payload but does not verify the JWT signature against Apple's public keys or validate core claims such as issuer, audience, and expiry. The attack is further enabled by a login-flow nonce that is exposed to unauthenticated users through a localized JavaScript object on the login page. The issue has a **CVSS 9.8** rating and is classified as **`CWE-289`**, reflecting the risk of full account takeover and complete site compromise when an administrator account is targeted. The vulnerability is fixed in **`2.8.8`**, and public reporting said no active exploitation had been confirmed at the time of disclosure.
Aug 2, 2026
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026