Loading vulnerability…
Missing authorization in FunnelKit Funnel Builder for WooCommerce Checkout
CVE-2026-47100 is a missing authorization vulnerability in FunnelKit Funnel Builder for WooCommerce Checkout versions before 3.15.0.3. The public checkout AJAX endpoint dispatches caller-supplied requests to internal methods without authorization checks or restrictions on callable methods. Unauthenticated attackers can invoke a method that writes arbitrary content to the global External Scripts setting. This setting is rendered on plugin-generated checkout pages, enabling persistent malicious JavaScript execution in visitors' browsers. Active exploitation has involved Magecart-style payment skimmers.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can modify the plugin's global External Scripts setting and persist malicious scripts across affected checkout pages. The injected JavaScript executes in checkout visitors' browsers. Observed exploitation uses payment skimmers to intercept credit card numbers, CVVs, and billing addresses and exfiltrate them to attacker-controlled infrastructure.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling the affected checkout functionality or the plugin until an update can be applied. Review and remove any unauthorized content from the plugin's External Scripts setting and inspect checkout-page source for unexpected injected JavaScript. Because exploitation can result in persistent client-side skimmers, incident response should include validation of checkout integrity, review of administrative and plugin configuration changes, and assessment of potential payment-data exposure. Additional defensive controls such as web application firewall rules for the vulnerable public endpoint may reduce opportunistic exploitation, but they are not a substitute for upgrading to the fixed version.
Patch, then assume compromise.
Upgrade FunnelKit Funnel Builder for WooCommerce Checkout to version 3.15.0.3 or later. Version 3.15.0.3 adds endpoint capability checks, a strict allowlist of callable methods, and nonce verification before processing requests.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.