What’s Vulnerable › Vulnerabilities

CVE-2026-47100: Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-19 · updated 2026-07-24
• Weakness: CWE-862

Description

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

Affected products

• FunnelKit Funnel Builder for WooCommerce Checkout: before 3.15.0.3 — fixed in 3.15.0.3

How to fix

Upgrade to a fixed version: FunnelKit Funnel Builder for WooCommerce Checkout 3.15.0.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3530797/funnel-builder/tags/3.15.0.3/modules/checkouts/includes/class-wfacp-ajax-controller.php
• https://sansec.io/research/funnelkit-woocommerce-vulnerability-exploited
• https://www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax
• https://sansec.io/research/funnelkit-woocommerce-vulnerability-exploited

Get alerted when CVE-2026-47100 or the next vulnerability affects your stack