Funnel Builder WordPress Plugin Exploited to Steal Credit Cards
A critical vulnerability in the Funnel Builder plugin for WordPress is under active exploitation, according to BleepingComputer. Attackers are injecting malicious JavaScript snippets directly into WooCommerce checkout pages. This highly effective tactic allows them to skim credit card details and other sensitive payment information as users complete purchases.
The widespread use of WordPress and WooCommerce makes this a high-impact threat. Any organization running the Funnel Builder plugin for e-commerce operations is a potential target. The attackers’ calculus is clear: target the point of transaction to maximize direct financial gain, leveraging a known flaw in a popular plugin.
What This Means For You
- If your organization uses the Funnel Builder WordPress plugin, you need to audit your WooCommerce checkout pages immediately for injected malicious JavaScript. Prioritize patching this vulnerability *now* and ensure all payment processing infrastructure is secure. This isn't theoretical; it's active exploitation leading to direct credit card theft.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Funnel Builder Plugin - Malicious JavaScript Injection
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| Funnel-Builder-Exploit | Code Injection | Funnel Builder WordPress plugin |
| Funnel-Builder-Exploit | Code Injection | Malicious JavaScript injection into WooCommerce checkout pages |
| Funnel-Builder-Exploit | Information Disclosure | Credit card theft |
Written by SCW Vulnerability Desk
Related coverage on
THORChain Suffers $10.7M Crypto Heist from Vault Compromise
The cryptocurrency platform THORChain recently sustained a significant security incident, resulting in a loss of approximately $10.7 million. According to The Record by Recorded Future,...
node-ipc npm Package Compromised to Steal Credentials
BleepingComputer reports a critical supply chain attack targeting the popular `node-ipc` npm package. Attackers injected credential-stealing malware into newly published versions, specifically targeting developers who...
Turla Transforms Kazuar Backdoor into Modular P2P Botnet
The Russian state-sponsored hacking group Turla has evolved its custom backdoor, Kazuar, into a sophisticated modular peer-to-peer (P2P) botnet. This upgrade, reported by The Hacker...