Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming
Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming — Ravie LakshmananMay 16, 2026Vulnerability / Website Security [https://
What’s new: A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages, aiming to steal payment data. The flaw affects all versions prior to 3.15.0.3 and allows unauthenticated attackers to insert arbitrary JavaScript, which can load a payment skimmer disguised as Google Tag Manager scripts.
Who’s affected
All users of the Funnel Builder plugin for WordPress, particularly those running versions before 3.15.0.3, are at risk. The plugin is used in over 40,000 WooCommerce stores.
What to do
- Update the Funnel Builder plugin to version 3.15.0.3 or later.
- Review Settings > Checkout > External Scripts for any unfamiliar entries and remove them.
