Which versions of Funnel Builder for WooCommerce Checkout are affected by CVE-2026-47100?

FunnelKit plugin versions prior to 3.15.0.3 contain a stored XSS vulnerability allowing unauthenticated attackers to inject malicious code on checkout pages for payment card skimming and customer…. A patch is available.

How to fix or mitigate CVE-2026-47100?

Within 24 hours: Identify all WooCommerce installations using FunnelKit versions prior to 3.15.0.3 and assess exposure scope. Within 7 days: Deploy FunnelKit patch to version 3.15.0.3 or later across all affected instances; audit External Scripts settings and server logs for unauthorized modifications. Within 30 days: Conduct forensic analysis of logs and database for exploitation indicators; notify customers of any confirmed data exposure; file PCI-DSS incident reports if required.

Funnel Builder for WooCommerce Checkout CVE-2026-47100

Q: What is the CVSS score of CVE-2026-47100?

CVE-2026-47100 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30936 HIGH

Missing Authorization (CWE-862)

2026-05-19 VulnCheck

GHSA-cffp-87j8-rff2

WordPress Authentication Bypass

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 19, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 19, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

May 19, 2026 - 15:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 19, 2026 - 15:01 vuln.today

DescriptionCVE.org

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

AnalysisAI

Stored cross-site scripting via missing authorization in Funnel Builder for WooCommerce Checkout (FunnelKit) plugin versions prior to 3.15.0.3 allows remote unauthenticated attackers to write arbitrary content to the plugin's External Scripts global setting through an exposed public AJAX endpoint. Injected JavaScript executes in the browser of every visitor to the WooCommerce checkout page, enabling credit card skimming, session theft, and credential harvesting. Publicly available exploit code exists and Sansec research indicates the flaw is being exploited in the wild against live e-commerce sites.

Technical ContextAI

FunnelKit's Funnel Builder is a widely deployed WordPress/WooCommerce plugin (CPE cpe:2.3:a:funnelkit:funnel_builder_for_woocommerce_checkout) used to build custom checkout funnels for online stores. The root cause is CWE-862 (Missing Authorization): the plugin's public AJAX controller (class-wfacp-ajax-controller.php) exposes internal methods through a checkout endpoint without verifying the caller's identity or capabilities (e.g., no current_user_can or nonce checks). One of the reachable methods updates the plugin's global 'External Scripts' option, which is intended to allow administrators to add tracking pixels and third-party scripts to checkout pages - making it a perfect sink for persistent JavaScript injection that loads on every customer's checkout page render.

RemediationAI

Vendor-released patch: upgrade Funnel Builder for WooCommerce Checkout to version 3.15.0.3 or later, which adds the missing authorization checks in class-wfacp-ajax-controller.php as shown in the WordPress.org changeset 3530797. Because Sansec reports active exploitation, treat upgrade as urgent and, after patching, audit the plugin's External Scripts setting (and any wfacp_* options in wp_options) for unfamiliar JavaScript, review checkout page HTML for unknown script tags, and rotate any customer payment-processing API keys that may have been exposed during the exposure window. If immediate patching is not possible, compensating controls include blocking the vulnerable AJAX action at the web server or WAF layer (deny POSTs to admin-ajax.php with the affected wfacp_* action parameter - note this will break the legitimate checkout flow until the plugin is updated), restricting access to /wp-admin/admin-ajax.php to authenticated sessions via reverse proxy (will break other anonymous AJAX consumers like cart updates), or temporarily deactivating the plugin (will disable custom checkout funnels and likely impact conversions).