EUVD-2026-30936
GHSA-cffp-87j8-rff2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WooCommerce store running FunnelKit
-
DeliverySend unauthenticated POST to admin-ajax.php
-
ExploitBypass missing authorization check
-
ExecutionOverwrite External Scripts setting with skimmer JS
-
PersistStored payload served on checkout page
-
ImpactExfiltrate customer payment data to attacker domain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target WordPress site has the Funnel Builder for WooCommerce Checkout plugin installed at a version below 3.15.0.3 and that its public AJAX endpoint (wp-admin/admin-ajax.php) is reachable from the internet - which is the default for any live WooCommerce store. No authentication, no user interaction, no non-default configuration, and no specific WooCommerce or WordPress version are required, matching the CVSS vector AV:N/AC:L/PR:N/UI:N. The principal limiting factor is plugin presence and version; sites running 3.15.0.3+ or that have removed/deactivated the plugin are not exploitable, and stores that block external access to admin-ajax.php (uncommon, as it breaks anonymous cart/checkout flows) would also frustrate the attack. |
| Impact | Despite the CVSS 4.0 base score of 8.7 reflecting only integrity impact (VC:N/VI:H/VA:N), real-world risk to e-commerce operators is severe: the vector is network-reachable, requires no authentication and no user interaction (AV:N/AC:L/AT:N/PR:N/UI:N), and the target - the WooCommerce checkout page - is precisely where attackers monetize stored XSS via Magecart-style card skimming. The Sansec advisory in the references explicitly reports exploitation in the wild, which materially raises priority above what the CVSS vector alone suggests; however, the CVE is not yet listed in CISA KEV and no EPSS score was supplied in the intelligence package, so quantitative exploitation probability is unconfirmed. The combination of trivial exploitation, a high-value target population (online merchants), and confirmed external exploitation reporting makes this a priority-1 patch even for stores not currently observing indicators of compromise. |
| Exploit ScenarioDerived | An attacker scans the internet for WooCommerce stores running vulnerable FunnelKit installations and sends a single unauthenticated POST to the store's admin-ajax.php endpoint, invoking the exposed internal method to overwrite the External Scripts plugin setting with a JavaScript card-skimmer payload. The payload is then served from the store's own checkout page to every paying customer, exfiltrating credit card numbers, CVVs, and billing details to an attacker-controlled domain. Public exploitation has been documented by Sansec, and proof-of-concept request structure is derivable from the patched controller file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 19, 2026
Stored cross-site scripting via missing authorization in Funnel Builder for WooCommerce Checkout (FunnelKit) plugin versions prior to 3.15.0.3 allows remote unauthenticated attackers to write arbitrary content to the plugin's External Scripts global setting through an exposed public AJAX endpoint. Injected JavaScript executes in the browser of every visitor to the WooCommerce checkout page, enabling credit card skimming, session theft, and credential harvesting. Publicly available exploit code exists and Sansec research indicates the flaw is being exploited in the wild against live e-commerce sites.
Earlier versions of this analysis (1)
Stored cross-site scripting via missing authorization in FunnelKit's Funnel Builder for WooCommerce Checkout plugin (versions prior to 3.15.0.3) allows unauthenticated remote attackers to write attacker-controlled JavaScript into the plugin's External Scripts global setting through the public checkout AJAX endpoint. The injected script then executes in the browser of every visitor to the checkout page, enabling payment skimming, session hijacking, and credential theft. Sansec research referenced in the advisory indicates real-world exploitation, though the CVE is not currently listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade Funnel Builder for WooCommerce Checkout to version 3.15.0.3 or later, which adds the missing authorization checks in class-wfacp-ajax-controller.php as shown in the WordPress.org changeset 3530797. Because Sansec reports active exploitation, treat upgrade as urgent and, after patching, audit the plugin's External Scripts setting (and any wfacp_* options in wp_options) for unfamiliar JavaScript, review checkout page HTML for unknown script tags, and rotate any customer payment-processing API keys that may have been exposed during the exposure window. If immediate patching is not possible, compensating controls include blocking the vulnerable AJAX action at the web server or WAF layer (deny POSTs to admin-ajax.php with the affected wfacp_* action parameter - note this will break the legitimate checkout flow until the plugin is updated), restricting access to /wp-admin/admin-ajax.php to authenticated sessions via reverse proxy (will break other anonymous AJAX consumers like cart updates), or temporarily deactivating the plugin (will disable custom checkout funnels and likely impact conversions).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FunnelKit's Funnel Builder is a widely deployed WordPress/WooCommerce plugin (CPE cpe:2.3:a:funnelkit:funnel_builder_for_woocommerce_checkout) used to build custom checkout funnels for online stores. The root cause is CWE-862 (Missing Authorization): the plugin's public AJAX controller (class-wfacp-ajax-controller.php) exposes internal methods through a checkout endpoint without verifying the caller's identity or capabilities (e.g., no current_user_can or nonce checks). One of the reachable methods updates the plugin's global 'External Scripts' option, which is intended to allow administrators to add tracking pixels and third-party scripts to checkout pages - making it a perfect sink for persistent JavaScript injection that loads on every customer's checkout page render.
Know when Funnel Builder For Woocommerce Checkout gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
Executive ViewAI
FunnelKit plugin versions prior to 3.15.0.3 contain a stored XSS vulnerability allowing unauthenticated attackers to inject malicious code on checkout pages for payment card skimming and customer session theft. Publicly available exploit code exists and Sansec research documents active exploitation against production e-commerce systems, placing organizations running affected versions at immediate risk of payment card compromise and PCI-DSS violation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB