Critical Security Alert: WooCommerce 'Funnel Builder' Vulnerability Leads to Active Credit Card Skimming Campaign

A severe security vulnerability in the popular Funnel Builder plugin for WordPress, developed by FunnelKit, is currently being exploited in the wild. Threat actors are leveraging an unauthenticated flaw to inject malicious JavaScript into WooCommerce checkout pages, effectively transforming legitimate e-commerce sites into conduits for credit card theft.

The security incident, which impacts over 40,000 websites, has prompted an urgent warning from security researchers and the software vendor alike. With e-commerce security under constant pressure, this breach highlights the persistent danger posed by third-party plugin vulnerabilities in the WordPress ecosystem.

The Core Vulnerability: An Unprotected Gateway

The vulnerability resides within the core configuration logic of the Funnel Builder plugin. Funnel Builder is a sophisticated toolset designed to help WooCommerce merchants optimize conversion rates through custom checkout pages, one-click upsells, and tailored landing pages.

According to technical analysis provided by e-commerce security firm Sansec, the flaw allows an attacker to modify the plugin’s global settings via an unprotected, publicly exposed checkout endpoint. Because this endpoint lacks sufficient authentication or authorization checks, anyone on the internet can interact with it to overwrite critical configuration parameters.

Specifically, the attacker is able to inject arbitrary JavaScript code into the plugin’s "External Scripts" setting. This feature is intended for legitimate use, such as adding marketing pixels or tracking scripts. However, by weaponizing this setting, attackers ensure that their malicious payload executes on every single checkout page visited by customers.

Chronology of the Incident

The discovery and subsequent response to the campaign have moved rapidly, reflecting the high stakes involved in active financial data theft.

Early Discovery: Security researchers at Sansec identified suspicious activity during routine monitoring of e-commerce traffic. They observed anomalous WebSocket connections originating from checkout pages across a wide array of independent WooCommerce stores.
The Campaign Launch: Investigators traced the malicious script back to a domain identified as analytics-reports[.]com. The payload, disguised as a legitimate jquery-lib.js file, was engineered to mimic a Google Tag Manager or Google Analytics script to evade detection by site administrators.
Active Exploitation: The malicious script establishes a persistent WebSocket connection to an attacker-controlled server (wss://protect-wss[.]com), allowing for the real-time exfiltration of payment data entered by unsuspecting shoppers.
The Disclosure: Sansec notified the vendor, FunnelKit, providing the necessary technical evidence to confirm the vulnerability.
The Patch: On May 14, 2026, FunnelKit released version 3.15.0.3 of the Funnel Builder plugin, which includes a critical security patch to close the unauthorized endpoint and restrict access to plugin settings.

Technical Analysis: Anatomy of the Skimmer

The skimmer deployed in this campaign is a textbook example of a modern "Magecart-style" attack, optimized for stealth and persistence. By masquerading as a common analytics script, the attacker ensures that the malicious code blends in with the dozens of other legitimate scripts typically running on a modern e-commerce site.

How the Data Exfiltration Works

When a customer reaches the checkout page, the injected script monitors the DOM (Document Object Model) for input fields. As the user enters their name, billing address, credit card number, CVV, and expiration date, the script captures these keystrokes in real-time.

Instead of sending this data via standard HTTP POST requests—which are often monitored by Web Application Firewalls (WAFs)—the script utilizes a WebSocket connection. WebSockets provide a full-duplex communication channel over a single TCP connection, which is frequently less scrutinized by legacy security tools. This allows the attacker to siphon data off the site without triggering common security alerts.

The Scope of the Impact

The vulnerability affects all versions of Funnel Builder prior to 3.15.0.3. Because the plugin is active on more than 40,000 websites, the potential pool of victimized businesses is significant. Given the nature of the attack, the impact is not limited to the merchant; it directly compromises the financial privacy and security of every customer who completed a transaction during the period of exploitation.

Funnel Builder WordPress plugin bug exploited to steal credit cards

Official Responses and Remediation

FunnelKit has acknowledged the gravity of the situation. In a security advisory, the company confirmed that they had identified the issue, stating, "We identified an issue that allowed bad actors to inject scripts."

Immediate Steps for Site Administrators

If you operate a WooCommerce store using the Funnel Builder plugin, you are urged to take the following steps immediately:

Update Immediately: Log into your WordPress dashboard and update Funnel Builder to version 3.15.0.3 or higher. This is the most critical step to prevent further unauthorized access.
Audit External Scripts: Navigate to the plugin settings under Settings > Checkout > External Scripts. Review every script present in this section. If you see any code that you did not personally authorize, or if you see references to analytics-reports[.]com or protect-wss[.]com, delete them immediately.
Check for Persistence: Even after updating, scan your site for backdoors. Attackers often use an initial vulnerability to upload web shells or create new administrative users to maintain access. If your site behaves unusually, consider restoring from a backup made prior to the breach.
Monitor Financial Logs: If possible, review transaction logs for signs of anomalous behavior. While the breach is client-side, it is good practice to ensure no backend data corruption occurred.

The Broader Implications for E-commerce Security

This incident serves as a stark reminder of the "supply chain" risks inherent in the WordPress ecosystem. When a single plugin vulnerability can be leveraged to compromise thousands of individual merchants, the security of the entire platform is only as strong as its weakest dependency.

The "Validation Gap" in Security

Many merchants rely on automated pentesting tools that focus on network-level security. However, as noted by industry experts, these tools often fail to account for the "Validation Gap." An automated tool might confirm that a firewall is running, but it cannot always detect when an application-level flaw allows an attacker to inject logic that subverts the entire payment process.

The Lifecycle of Stolen Data

Once credit card information is exfiltrated, it rarely stays in the hands of the initial attacker. The lifecycle typically follows a predictable path:

Collection: The attacker gathers bulk data from compromised sites.
Validation: Automated tools check if the stolen cards are active and have available credit.
Marketplace Listing: Validated cards are sold on dark web "carding markets," where they are purchased by other criminals for fraudulent online purchases.
Monetization: The fraud often leads to "chargebacks" for the merchant, which can result in increased payment processing fees, loss of merchant accounts, and severe reputational damage.

Regulatory and Legal Consequences

Beyond the direct financial loss, merchants who fail to secure their sites against known vulnerabilities may face legal and regulatory scrutiny. Under various data protection regulations (such as GDPR in Europe or CCPA in California), businesses are required to implement reasonable security measures to protect consumer data. A breach resulting from an unpatched, publicly known vulnerability can serve as evidence of negligence, potentially leading to heavy fines and mandatory audits.

Conclusion: A Call for Vigilance

The Funnel Builder vulnerability is a wake-up call for the WordPress community. The ease with which an unauthenticated user could modify global plugin settings underscores the need for "Secure by Design" principles in third-party development.

For the average site owner, the complexity of maintaining a secure e-commerce environment can feel overwhelming. However, the most effective defense remains a proactive posture: staying informed about security updates, minimizing the use of unnecessary plugins, and conducting regular audits of site configurations.

In the digital economy, trust is the most valuable currency. By acting swiftly to patch this vulnerability, merchants can demonstrate their commitment to customer security and help mitigate the damage caused by this ongoing skimming campaign. If you are a user of the Funnel Builder plugin, do not wait for a maintenance window—update your installation today.