Loading story…
Attackers exploited CVE-2020-36731, an unauthenticated settings-update vulnerability in the WordPress plugin Flexible Checkout Fields for WooCommerce, to inject scripts into WooCommerce checkout pages. The flaw affects versions earlier than 2.3.2 and allows attackers to modify plugin settings without logging in. Nintechnet reported the issue as a zero-day vulnerability; the vulnerability record lists public disclosure on February 25, 2020.
The vulnerability was fixed in version 2.3.2. Sites still running affected versions should upgrade to a supported release containing the fix and inspect plugin settings and checkout pages for unauthorized changes or injected scripts. Because exploitation targeted checkout pages, affected merchants should assess potential exposure of customer and payment information, although the supplied reports do not establish confirmed data theft.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The unauthenticated settings-update vulnerability affecting Flexible Checkout Fields for WooCommerce versions earlier than 2.3.2 was publicly disclosed on February 25, 2020.
Version 2.3.2 of Flexible Checkout Fields for WooCommerce fixed the unauthenticated settings-update vulnerability tracked as CVE-2020-36731.
Attackers actively exploited an unauthenticated settings-update vulnerability in Flexible Checkout Fields for WooCommerce to inject scripts into checkout pages. The flaw affects plugin versions earlier than 2.3.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 16, 2026
A critical vulnerability in Funnel Builder by FunnelKit, a WooCommerce checkout and upsell plugin used by more than 40,000 stores, has been actively exploited to inject malicious JavaScript into checkout pages. The flaw affects all versions before `3.15.0.3` and stems from a public checkout endpoint that allowed unauthenticated attackers to modify the plugin’s global settings, including the **External Scripts** option, without proper capability checks. Attackers used the weakness to plant fake Google Tag Manager or analytics-style code that loaded a payment skimmer and stole card numbers, CVVs, billing addresses, and other customer data during checkout. Sansec said one observed attack chain fetched code from `analytics-reports[.]com` and opened a WebSocket connection to `protect-wss[.]com` to deliver a store-specific skimmer. FunnelKit released version `3.15.0.3` to restrict the endpoint to safe methods and add authorization checks, and defenders have been urged to update immediately and review the plugin’s External Scripts configuration for unauthorized entries.
May 15, 2026
An authenticated stored cross-site scripting vulnerability in the WordPress **Login/Signup Popup** plugin allowed logged-in users to inject JavaScript into plugin settings and target administrators in the WordPress backend. Tracked as **CVE-2020-36715**, the flaw affects versions earlier than **1.5** of the plugin, also identified as `easy-login-woocommerce`. Missing capability checks and a security nonce exposed the settings through the plugin’s AJAX API. WPScan assigns the vulnerability a critical CVSS score of **9.9**. The vulnerability was publicly disclosed on May 14, 2020, and WPScan reports that exploitation had already been occurring for a couple of days. NinTechNet also reported the fix for the zero-day vulnerability. **Version 1.5 fixes the flaw**; organizations still running an affected version should upgrade to a current supported release and review plugin settings for injected JavaScript, particularly where untrusted users can register or authenticate.
Feb 18, 2016