---
title: "FunnelKit Flaw Let Attackers Plant WooCommerce Card Skimmers"
slug: "funnelkit-checkout-skimming-cve-2026-47100"
description: "The FunnelKit vulnerability CVE-2026-47100 let attackers plant card skimmers on WooCommerce checkouts. Check your version and clean up."
date: 2026-09-14
author: "WP Vanguard Team"
category: "Research"
tags: ["funnelkit-vulnerability", "cve-2026-47100", "woocommerce", "payment-skimming", "magecart"]
featured_image: "/images/blog/funnelkit-checkout-skimming-cve-2026-47100.jpg"
---

Wordfence's record, which feeds our vulnerability database, lists the FunnelKit vulnerability behind CVE-2026-47100 at CVSS 5.3, medium severity. The National Vulnerability Database scores the same bug at 7.5 on the CVSS 3.1 scale and 8.7 on CVSS 4.0, both high. Sansec found attackers using it to plant JavaScript card skimmers on WooCommerce checkout pages. Three scores, one real-world outcome: stolen credit card data.

That gap is worth sitting with before we get into the technical details. A CVSS score describes how a vulnerability works: how easy it is to reach, what a caller needs to invoke it, what it touches. It doesn't describe what an attacker does once they're in. FunnelKit's bug let an unauthenticated visitor write arbitrary text into one settings field. Read that sentence in isolation and it sounds contained. Read it after knowing that field renders as a script tag on every checkout page, and it sounds like exactly what it turned out to be.

## What FunnelKit Is and What Broke

FunnelKit (WordPress.org slug `funnel-builder`) is a WooCommerce checkout customization and sales funnel plugin. Store owners use it to replace the default WooCommerce checkout, add order bumps, and run one-click upsells. The plugin currently shows 30,000+ active installations on WordPress.org; at the time of the incident in May 2026, Sansec and The Hacker News both put the figure at more than 40,000 stores.

One of FunnelKit's settings is an External Scripts field under its checkout configuration, meant for store owners to load Google Tag Manager, Facebook Pixel, or other tracking code on checkout pages. According to the National Vulnerability Database and the VulnCheck advisory that assigned CVE-2026-47100, versions of FunnelKit prior to 3.15.0.3 contained a missing authorization vulnerability (CWE-862) in the plugin's public checkout endpoint. That endpoint let unauthenticated attackers invoke internal plugin methods and write arbitrary data into the External Scripts setting, with no capability check standing in the way. FunnelKit fixed it in version 3.15.0.3, and the advisory was published May 19, 2026.

The public checkout endpoint has to accept unauthenticated requests by design; that's how anyone can check out without an account. The bug was that the same endpoint let a caller reach internal methods it was never supposed to expose, including the one that writes plugin settings. For a broader look at how these access-control gaps show up across WooCommerce extensions, see our [WooCommerce security guide](/blog/wordpress-security-woocommerce).

## The Skimmer Sansec Found

Sansec's forensics team published research on May 14, 2026, describing active exploitation of this flaw before the CVE was even assigned. The attack Sansec documented injected a script into External Scripts disguised as a Google Tag Manager loader, a base64-encoded reference to `https://analytics-reports[.]com/wss/jquery-lib.js`. Next to a store's real GTM snippet, it reads as routine analytics.

That script wasn't analytics. Per Sansec's writeup, it opened a WebSocket connection to `wss://protect-wss[.]com/ws`, which streamed back a skimmer built for the specific victim store's checkout layout. The skimmer read credit card numbers, CVV codes, billing addresses, and other personal details as customers typed them at checkout, sending the data out before the legitimate WooCommerce order handler ever fired. Sansec's report and The Hacker News's coverage both describe the same core mechanism: fake analytics script, WebSocket handshake, tailored skimmer payload.

There's an important caveat here. Our own exploitation database doesn't carry a record for CVE-2026-47100, and CVE-2026-47100 does not appear in CISA's Known Exploited Vulnerabilities catalog as of this writing. The exploitation claim in this post rests entirely on Sansec's published research and the reporting that followed it, not on telemetry we collected ourselves. That's still solid sourcing for a working security research team, just worth being precise about where the evidence comes from.

## Why the WebSocket Design Matters

Loading a skimmer through a live WebSocket rather than a static script URL means the attacker can change the payload without touching the compromised site again. A signature-based scanner that flags today's script content won't necessarily catch tomorrow's, because the actual skimming code never sits still on the FunnelKit settings page. The settings page only ever holds the loader.

That's also why a quick glance at External Scripts isn't a clean bill of health. The loader can look plausible for weeks and change what it fetches from the command-and-control server at any point. This is the same category of attack our [WooCommerce security guide](/blog/wordpress-security-woocommerce) covers under payment skimming in general; this incident is the specific version of it that shipped through a real, patched vulnerability with a real CVE number.

## Checking Whether Your Store Was Hit

Start with the version. If you're running anything older than 3.15.0.3, you were exposed to this flaw for as long as it sat unpatched:

```bash
wp plugin get funnel-builder --field=version
```

If the result is 3.15.0.2 or earlier, update before doing anything else:

```bash
wp plugin update funnel-builder
```

Updating stops new attacks. It does not undo one already sitting in your database. Next, look directly at the setting attackers targeted. In wp-admin, that's FunnelKit's checkout settings, under the External Scripts field. Anything you didn't add yourself, especially a script that resembles Google Tag Manager but points at a domain you don't recognize, is a finding.

Because the setting lives in the database rather than in a file, a file-integrity scanner won't catch it. Search the options table directly instead, backing up first:

```bash
wp db export --add-drop-table ./backup-before-review-$(date +%F).sql
wp db search "wss://" --all-tables
wp db search "analytics-reports" --all-tables
wp db search "protect-wss" --all-tables
```

`wp db search` reports which rows match without changing anything, so it's safe to run before you've decided what to do about a hit. A match in `wp_options` pointing at a domain you don't control is the same signal the Sansec IOCs describe: `analytics-reports[.]com` and `protect-wss[.]com` were the specific domains in that campaign, though a different or later wave could use different infrastructure entirely.

## Cleaning Up If You Find One

If External Scripts contains a script you didn't add, treat the store as compromised for the window it was live, not just for the moment you noticed it. Clear the field back to only what you intentionally configured, then confirm the change actually took by reloading the checkout page in a private browser window and checking the page source for the removed script tag.

Cache layers can keep serving the old, compromised page to visitors even after you've cleared the setting in the database:

```bash
wp cache flush
wp transient delete --all
```

Clear any object cache, full-page cache plugin, or CDN cache the same way; a database fix that's still being served from cache protects nobody. Then work through the harder questions: which orders were placed while the skimmer was live, whether your payment processor needs notice, and whether any customers need to be told their card data may have been exposed. Our [guide to detecting and removing a WooCommerce payment skimmer](/blog/wordpress-security-woocommerce) and our [general signs a WordPress site has been hacked](/blog/signs-wordpress-site-hacked) cover the parts of that response that go beyond this one plugin: checking for unfamiliar admin accounts, rotating credentials, and confirming nothing else rode in alongside the skimmer.

If you find anything that looks like it went further than a settings-field script injection, our [WordPress malware removal guide](/blog/wordpress-malware-removal-guide) walks through a fuller cleanup, including what to do before you consider the incident closed.

## The Lesson in the Score Itself

A missing authorization check on a settings write doesn't sound like much next to an unauthenticated remote code execution bug. Scored in isolation, on the mechanics of the flaw alone, it can reasonably land at medium. What decides the real-world damage is what the setting controls. Here, it controlled a script tag rendered on every visit to the one page on a WooCommerce store where a stranger's JavaScript can read a credit card number as it's typed.

That's a pattern worth remembering past this specific plugin. Any "write to this setting" bug on a page that renders unescaped output deserves a second look at what gets rendered, regardless of what the calculator says about attack complexity. The number tells you how hard the door is to open. It doesn't tell you what's behind it.

[Run a scan on your site](/#scanner) to check your FunnelKit version against our vulnerability database and look for signs a skimmer already made it in.

## References

- [Sansec: Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts](https://sansec.io/research/funnelkit-woocommerce-vulnerability-exploited)
- [The Hacker News: Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming](https://thehackernews.com/2026/05/funnel-builder-flaw-under-active.html)
- [NVD: CVE-2026-47100 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-47100)
- [VulnCheck Advisory: Funnel Builder for WooCommerce Checkout Missing Authorization via AJAX](https://www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax)
- [FunnelKit plugin page on WordPress.org](https://wordpress.org/plugins/funnel-builder/)