Funnel Builder for WooCommerce Checkout prior to 3

CVE-2026-47100 is a missing authorization flaw in FunnelKit's *Funnel Builder for WooCommerce Checkout* affecting all versions before 3.15.0.3. The public checkout endpoint can be reached without authentication and, per NVD and Sansec, older builds let the request invoke internal methods that write attacker-controlled data into the plugin's External Scripts global setting. Because that setting is rendered into checkout pages, an attacker can plant JavaScript that runs in every shopper's browser during payment.

The vendor-style HIGH 7.5 baseline understates reality for defenders. In a lab this is 'just' integrity impact in the browser, but in production it sits on an internet-facing payment workflow, is unauthenticated, and has active exploitation evidence tied to card-skimming behavior. That combination pushes this into CRITICAL operational priority even though it is not server-side RCE.

Why this verdict

• Upgraded for active exploitation: Sansec reported real-world skimming activity, which overrides the comfort you might otherwise take from the low EPSS and lack of KEV listing.
• Unauthenticated remote on a public path: no prior foothold, no account, and no victim interaction are required to plant the malicious checkout script.
• Checkout blast radius is business-critical: compromise lands on the revenue path and can impact every shopper using the affected flow, turning one plugin bug into a payment-card incident.

Why not higher?

This is not a 10.0 class event because it does not directly yield server-side code execution, domain-wide takeover, or cross-tenant propagation. The affected population is also limited to stores running this specific plugin below 3.15.0.3, not all WordPress or all WooCommerce deployments.

Why not lower?

A downgrade would ignore the real-world context that matters most: documented exploitation and a public unauthenticated attack surface. Even though the technical primitive is 'just' stored script injection via settings abuse, on a checkout page that is operationally equivalent to a live payment-skimming incident.

1. Block the vulnerable checkout request pattern — Deploy a WAF or reverse-proxy rule to deny suspicious unauthenticated POSTs to Funnel Builder/WooCommerce checkout endpoints that attempt method invocation or settings writes. Because exploitation is already reported, do this within hours, not days, to buy time for hosts you cannot patch immediately.
2. Audit and purge External Scripts now — Review Funnel Builder's checkout-related script settings for unknown analytics/tag-manager snippets, encoded loaders, or new third-party domains, then remove anything unauthorized. Do this within hours because patching alone does not remove an already-planted skimmer.
3. Turn on payment-page integrity monitoring — Add or tighten CSP reporting, client-side script inventory checks, and alerting for new JavaScript on checkout pages. Deploy this within 3 days at minimum so future script drift is caught even if another plugin or admin path is abused.
4. Hunt for anomalous checkout endpoint traffic — Search web and CDN logs for unusual POSTs to Funnel Builder/WooCommerce checkout endpoints from bots, scanners, or non-customer user agents, especially around 2026-05-14 onward when active abuse was publicly reported. Start within hours so you can triage likely-compromised stores before fraud reports arrive.

Run this on the target WordPress host or inside the web container with read access to the site files. Invoke it as bash check_funnelkit_cve_2026_47100.sh /var/www/html and use a user that can read wp-content/plugins; root is not required unless file permissions are restrictive.

#!/usr/bin/env bash
# check_funnelkit_cve_2026_47100.sh
# Detects whether Funnel Builder for WooCommerce Checkout is below 3.15.0.3
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

TARGET_VERSION="3.15.0.3"
WP_ROOT="${1:-}"

if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN: usage: $0 /path/to/wordpress"
  exit 2
fi

PLUGIN_FILE="$WP_ROOT/wp-content/plugins/funnel-builder/funnel-builder.php"
README_FILE="$WP_ROOT/wp-content/plugins/funnel-builder/readme.txt"

if [[ ! -f "$PLUGIN_FILE" ]]; then
  echo "UNKNOWN: Funnel Builder plugin file not found at $PLUGIN_FILE"
  exit 2
fi

get_version() {
  local file="$1"
  if [[ -f "$file" ]]; then
    grep -E '^\s*Version:' "$file" | head -n1 | sed -E 's/^\s*Version:\s*//'
  fi
}

VERSION="$(get_version "$PLUGIN_FILE" || true)"

if [[ -z "$VERSION" && -f "$README_FILE" ]]; then
  VERSION="$(grep -E '^\s*Stable tag:' "$README_FILE" | head -n1 | sed -E 's/^\s*Stable tag:\s*//')"
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not determine installed Funnel Builder version"
  exit 2
fi

version_lt() {
  local a="$1"
  local b="$2"
  [[ "$a" != "$b" && "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" == "$a" ]]
}

STATUS="PATCHED"
EXITCODE=0
if version_lt "$VERSION" "$TARGET_VERSION"; then
  STATUS="VULNERABLE"
  EXITCODE=1
fi

# Optional lightweight artifact check if wp-cli is available.
SUSPICIOUS_NOTE=""
if command -v wp >/dev/null 2>&1 && [[ -f "$WP_ROOT/wp-config.php" ]]; then
  if wp --path="$WP_ROOT" option list --format=csv >/dev/null 2>&1; then
    HITS="$(wp --path="$WP_ROOT" option list --format=csv 2>/dev/null | grep -Ei 'external.?scripts|wfacp|script' | head -n 5 || true)"
    if [[ -n "$HITS" ]]; then
      SUSPICIOUS_NOTE=" | NOTE: review Funnel Builder checkout/script-related options with wp-cli"
    fi
  fi
fi

echo "$STATUS: Funnel Builder version $VERSION (fixed in $TARGET_VERSION)$SUSPICIOUS_NOTE"
exit $EXITCODE

Sources

1. NVD CVE-2026-47100
2. Sansec research on active exploitation
3. WordPress.org Funnel Builder plugin page and changelog
4. FunnelKit release notes for 3.15.0.3
5. VulnCheck advisory
6. BleepingComputer coverage
7. CISA Known Exploited Vulnerabilities Catalog
8. Tenable CVE page with EPSS display