CVE-2026-47100: Funnel Builder for WooCommerce Checkout Vulnerability

The National Vulnerability Database reports a critical missing authorization vulnerability, CVE-2026-47100, in the Funnel Builder for WooCommerce Checkout plugin, affecting versions prior to 3.15.0.3. This flaw allows unauthenticated attackers to exploit the public checkout endpoint, invoking internal methods and injecting arbitrary data into the plugin’s External Scripts global setting.

Attackers can leverage this to inject malicious JavaScript. This script then executes in the browsers of all visitors to the checkout page, leading to potential client-side compromises. The National Vulnerability Database assigns this a CVSS score of 7.5 (High), underscoring the severity of the unauthenticated access and high integrity impact.

This vulnerability represents a significant threat to e-commerce operations using the affected plugin. The ability to inject malicious scripts into a critical path like the checkout page can lead to data theft, session hijacking, or redirection to phishing sites, directly impacting customer trust and business continuity.