Funnel Builder Flaw Exploited to Enable Woo Commerce Checkout Skimming
Summary: Sansec reported active exploitation of a vulnerability with no CVE identifier in the Funnel Builder plugin for WordPress, affecting all versions before 3.15.0.3 and used by more than 40,000 WooCommerce stores. Unauthenticated attackers write attacker-controlled data into the plugin's global settings through a publicly exposed checkout endpoint that never checked caller permissions, injecting JavaScript into every checkout page that masquerades as a Google Tag Manager loader and pulls a skimmer from a WebSocket command-and-control server at wss://protect-wss[.]com/ws.
Why it matters: FunnelKit says its monitoring of more than 1,300 sites over the nine days after disclosure found only three with signs of compromise before mitigations took effect - a reminder that a skimmer dressed as a familiar analytics tag can sit in a checkout setting that reviewers skim past.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026