Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming
A critical Funnel Builder plugin flaw is being actively exploited to inject payment skimmers into WooCommerce checkout pages. Patch to 3.15.0.3 now.
What’s new: A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages, aiming to steal payment data. The flaw affects all versions prior to 3.15.0.3 and allows unauthenticated attackers to inject arbitrary JavaScript, which can load a payment skimmer disguised as Google Tag Manager scripts. FunnelKit has released a patch to address this issue.
Who’s affected
All users of the Funnel Builder plugin for WordPress prior to version 3.15.0.3, which is utilized in over 40,000 WooCommerce stores.
What to do
- Update the Funnel Builder plugin to version 3.15.0.3 or later.
- Review the Settings > Checkout > External Scripts for any unfamiliar entries and remove them.
