CVE-2026-47100

The vulnerability in the Funnel Builder for WooCommerce Checkout prior to version 3.15.0.3 is characterized by a missing authorization check in the public checkout endpoint. This flaw allows unauthenticated attackers to access internal methods that should be restricted to authorized users. Specifically, the vulnerability permits the injection of arbitrary data into the plugin's External Scripts global setting. By exploiting this weakness, attackers can insert malicious JavaScript code that executes in the browsers of all visitors to the checkout page, leading to potential data theft, session hijacking, or other malicious activities.

Attack vectors for this vulnerability are primarily web-based, targeting the checkout functionality of e-commerce sites utilizing the affected plugin. An attacker could craft a specially designed HTTP request to the public checkout endpoint, bypassing any authentication mechanisms that are typically in place. Once the malicious script is injected, it can execute in the context of the user’s browser, allowing the attacker to perform actions such as capturing keystrokes, stealing cookies, or redirecting users to phishing sites. This exploitation can occur without any user interaction, making it particularly insidious as it can affect a wide range of users visiting the checkout page.

The real-world impact of this vulnerability is significant, especially for businesses relying on WooCommerce for online transactions. The injection of malicious JavaScript can lead to severe reputational damage, loss of customer trust, and potential financial losses due to fraud. Furthermore, if sensitive customer information is compromised, businesses may face legal repercussions and regulatory fines, particularly in jurisdictions with stringent data protection laws. The risk is amplified for e-commerce platforms, where the integrity of the checkout process is crucial for maintaining customer confidence and ensuring smooth transactions.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regular security audits and code reviews can help identify and rectify missing authorization checks in web applications. Additionally, employing web application firewalls (WAFs) can provide an additional layer of defense by filtering out malicious requests before they reach the application. It is also essential to keep all plugins and software components up to date, as developers often release patches to address known vulnerabilities. Educating users about the risks of executing scripts from untrusted sources can further reduce the likelihood of successful exploitation.

In conclusion, the missing authorization vulnerability in the Funnel Builder for WooCommerce Checkout poses a serious threat to e-commerce platforms. The potential for unauthorized access and script injection can lead to significant business risks, including financial loss and reputational damage. Organizations must prioritize the detection and mitigation of such vulnerabilities through proactive security measures, regular updates, and user education to safeguard their operations and customer data.

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2026-47100, indicating that attempts to exploit the missing authorization vulnerability in Funnel Builder for WooCommerce Checkout have become more frequent. This uptick in telemetry corresponds with the assignment of a high CVSS score, reflecting the growing recognition of the vulnerability’s potential impact. Although no new exploit techniques or proof-of-concept code have surfaced, the increased targeting suggests that threat actors are actively probing affected environments, raising the likelihood of successful compromise. The elevated EPSS score, while still low, signals an emerging risk that defenders must monitor closely. This shift underscores the urgency for organizations using the affected plugin to reassess their exposure, as the vulnerability’s capacity for injecting malicious scripts into checkout pages poses a direct threat to customer security and business integrity. Consequently, the overall threat level has escalated from theoretical to actively targeted, warranting heightened vigilance.

Update 2 — June 07, 2026

CSURFACE threat intelligence has identified a new development in the exploitation landscape of CVE-2026-47100 with the emergence of publicly available proof-of-concept exploit code on GitHub. This marks a significant shift from prior conditions where no such exploit tools were accessible, effectively lowering the barrier for threat actors to weaponize the vulnerability. Concurrently, our telemetry indicates a modest but meaningful increase in the Exploit Prediction Scoring System (EPSS) value, reflecting a growing likelihood of exploitation attempts in the wild. While the absolute EPSS remains low, the upward trend coupled with the availability of exploit code signals an evolving threat environment that demands closer scrutiny. This change elevates the risk posture from a primarily theoretical concern to one of active targeting, increasing the urgency for defenders to monitor for exploitation attempts. The capacity for attackers to inject malicious JavaScript into checkout pages now has a more tangible exploitation vector, heightening potential impacts on customer security and transactional integrity.