CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

FunnelKit Funnel Builder for WooCommerce Checkout

product · product:funnelkit-funnel-builder-for-woocommerce-checkout

Coverage
1
first 2026-05-17 → last 2026-10-21
Latest activity
2026-05-17
Funnel Builder for WooCommerce flaw let attackers plant fake Google Tag Manager card skimmers on every…
Peak priority
notable
1 notable
Targets
retail
sectors: retail
Sources cited
4
4 hosts

Defender insights

What each entry about FunnelKit Funnel Builder for WooCommerce Checkout tells a defender to do, newest first.

2026-05-17NOTABLEexploitedFunnel Builder for WooCommerce flaw let attackers plant fake Google Tag Manager card skimmers on every checkout page

Exposure · triage · detection

Story timeline

  1. 2026-05-17FunnelKit Funnel Builder for WooCommerce: unauthenticated settings write (CVE-2026-47100) exploited to plant card skimmers on checkout pages, fixed in version 3.15.0.3
    active-threatsFunnel Builder for WooCommerce flaw let attackers plant fake Google Tag Manager card skimmers on every checkout page

Hunting pivots

CVEs (exploited first)
CVE-2026-47100
Releases covered
FunnelKit Funnel Builder for WooCommerce Checkout
Tags
data-breachpatch-availablepre-authvulnerabilities
ATT&CK techniques (6 across 6 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: JavaScript
  • StealthMasquerading: Match Legitimate Resource Name or Location · Deobfuscate/Decode Files or Information
  • Credential AccessInput Capture
  • CollectionInput Capture
  • Command and ControlApplication Layer Protocol: Web Protocols

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Credential Access TA0006

T1056Input Capture×1

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Collection TA0009

T1056Input Capture×1

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-05-17/funnelkit-funnel-builder-for-woocommerce-actively-exploited · ATT&CK page ↗

Entries about FunnelKit Funnel Builder for WooCommerce Checkout (1)

2026-05-17 · view entry permalink →

NOTABLECVE-2026-47100exploitedupdatedNATOB2

FunnelKit Funnel Builder for WooCommerce: unauthenticated settings write (CVE-2026-47100) exploited to plant card skimmers on checkout pages, fixed in version 3.15.0.3

Sansec reported on 2026-05-14 that it was tracking active attacks against Funnel Builder by FunnelKit, a checkout and upsell plugin used on 40,000+ WooCommerce stores, in which all versions before 3.15.0.3 let unauthenticated attackers inject arbitrary JavaScript into every checkout page (Sansec, 2026-05-14). The plugin's public checkout endpoint lets a request pick which internal method to run without checking the caller's permissions or restricting the methods, so an unauthenticated request can reach the method that writes the plugin's global settings, and whatever sits in the External Scripts setting is printed onto every Funnel Builder checkout page (Sansec, 2026-05-14). In at least one case Sansec found a payload posing as a Google Tag Manager loader beside the store's legitimate marketing tags: at page load it decodes a base64 string and loads that external script, which opens a WebSocket to the attacker's server and receives a skimmer tailored to the store that steals card numbers, CVVs, billing addresses and other personal details at checkout (Sansec, 2026-05-14). The flaw is tracked as CVE-2026-47100 and rated 8.7 in CVSS 4.0 (Sansec, 2026-05-14; ENISA EUVD-2026-30936).

FunnelKit shipped version 3.15.0.3 on 2026-05-14 (BleepingComputer, 2026-05-15), released the fix within 36 hours of the first report, pushed it to older release branches through WordPress.org so many stores updated without manual action, and DNS-blocked the attacker domains it knew (Sansec, 2026-05-14). In a statement added to The Hacker News report on 2026-05-31, FunnelKit said the exploitation path had been closed and that of more than 1,300 sites it monitored in the nine days after disclosure, three showed signs of compromise before its mitigations took effect (The Hacker News, 2026-05-16).

Triage: Sansec calls skimmers dressed as analytics tags a recurring Magecart pattern, because reviewers skip familiar tracking code; the planted loader names Google Analytics but at page load decodes a base64 string and loads its script from another host (Sansec, 2026-05-14).

All versions before 3.15.0.3 let unauthenticated attackers inject arbitrary JavaScript into every checkout page on the store.

Funnel Builder includes a public checkout endpoint that lets the request pick which internal method to run. Older releases never check the caller's permissions or restrict which methods are allowed.

Sansec 2026-05-14

Stores running version 3.15.0.3 or later, including those automatically updated through WordPress.org, are no longer vulnerable to this issue and are not exposed to the previously reported attack.

The overall impact appears to have been limited. During the nine days following disclosure, our monitoring covered a sample of more than 1,300 sites. Of those, only three showed signs of compromise before our mitigations took effect.

FunnelKit (via The Hacker News)
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevent_dateevidenceheadlineprioritysectorssourcessourcing_notesummarytagstechniquestitle

The flaw is tracked as CVE-2026-47100 and rated 8.7 in CVSS 4.0 (Sansec, 2026-05-14; ENISA EUVD-2026-30936). The 40,000+ figure is the number of stores using the plugin, not of exploited stores: Sansec found the fake Google Tag Manager loader in at least one case (Sansec, 2026-05-14), and FunnelKit said in a statement added to The Hacker News report on 2026-05-31 that of more than 1,300 sites it monitored in the nine days after disclosure, three showed signs of compromise before its mitigations took effect, and that the exploitation path had been closed after the fix was pushed to older branches through WordPress.org automatic updates (The Hacker News, 2026-05-16). The skimmer is tailored to each store and streamed over a WebSocket that the loader opens in the shopper's browser; no source describes WebSocket connections from the WordPress PHP process or exposure of Swiss or EU public portals, and the check FunnelKit advises is a review of the plugin's External Scripts setting (Sansec, 2026-05-14).

incident17 May 05:00Zmulti-sourceOpen finding →
Sources: Sansec · BleepingComputer · The Hacker News · ENISA EUVD (EUVD-2026-30936)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (25%)
  • euvd.enisa.europa.eu1 (25%)
  • sansec.io1 (25%)
  • thehackernews.com1 (25%)
All cited sources (4)