# Critical Funnel Builder Plugin Flaw Exploited to Harvest Credit Cards from 40,000+ WordPress Sites
A critical vulnerability in the Funnel Builder WordPress plugin for WooCommerce is being actively exploited to inject payment card-stealing malware into checkout pages, affecting more than 40,000 websites worldwide. Security researchers at Sansec detected the attacks and confirmed that threat actors are leveraging the flaw—which requires no authentication—to harvest credit card numbers, CVVs, and customer billing information in real-time.
## The Threat
Funnel Builder, a WooCommerce plugin developed by FunnelKit, has been compromised through an unauthenticated vulnerability that allows attackers to inject arbitrary JavaScript into checkout pages. The malicious code executes directly in customers' browsers during the payment process, capturing sensitive financial data before it reaches legitimate payment processors.
Sansec identified the active exploitation campaign and traced the payload to analytics-reports[.]com/wss/jquery-lib.js—a file designed to masquerade as Google Tag Manager or Google Analytics code. Once loaded, it establishes a WebSocket connection to an attacker-controlled server at wss://protect-wss[.]com/ws, enabling real-time communication between the compromised checkout page and the threat actor's infrastructure.
What attackers steal:
This type of payment card skimmer is among the most valuable malware in the cybercriminal ecosystem. Stolen payment data is immediately monetized through carding forums, sold in bulk lots on dark web markets, or used directly for fraudulent transactions.
## Background and Context
Funnel Builder is a legitimate, widely-used WordPress plugin that helps e-commerce store owners customize checkout experiences, implement one-click upsells, and optimize conversion rates. According to WordPress.org statistics, it is active on more than 40,000 websites, making it a high-value target for sophisticated attackers looking to reach payment infrastructure at scale.
The plugin was developed by FunnelKit, a company that provides conversion optimization tools for WooCommerce stores. While the tool itself provides legitimate business functionality, the security flaw discovered in versions prior to 3.15.0.3 created a backdoor into the most critical part of any e-commerce operation: the checkout page where payment information is collected.
Plugin scope:
## Technical Details
The vulnerability exists in an unprotected, publicly-accessible checkout endpoint that allows unauthenticated attackers to modify the plugin's global settings. This design flaw is particularly dangerous because it bypasses standard WordPress admin authentication mechanisms entirely.
### Exploitation Chain
Step 1: Access the vulnerable endpoint
The attacker identifies the unprotected endpoint that exposes checkout configuration parameters without requiring authentication or session validation.
Step 2: Inject JavaScript payload
The attacker injects malicious JavaScript code into the plugin's "External Scripts" setting—a legitimate feature designed to allow store owners to add third-party monitoring or analytics code to their checkout pages.
Step 3: Payload delivery
Once injected, the malicious script executes on every checkout page load, reaching every customer who attempts to purchase from the compromised store.
Step 4: Data exfiltration
The injected code creates a WebSocket connection to the attacker-controlled server, enabling bidirectional communication. The customer's payment form data is captured and transmitted to the threat actor in real-time.
### Why This Approach Works
Attackers disguised the payload as legitimate Google services to:
| Attack Component | Details |
|---|---|
| Vector | Unauthenticated HTTP endpoint |
| Payload | Custom JavaScript skimmer |
| Delivery Method | Injected into plugin settings |
| Execution Context | Customer browser (checkout page) |
| Data Target | Form fields containing payment data |
| Exfiltration | WebSocket to attacker server |
## Implications for Store Owners
### Immediate Risk
Any WooCommerce store running Funnel Builder prior to version 3.15.0.3 is at active risk of being compromised. Attackers are actively scanning for and exploiting the flaw. The lack of authentication requirements means they don't need to breach admin accounts or guess passwords—they can directly access the vulnerable endpoint.
### Regulatory and Legal Consequences
### Financial Impact
## Recommendations
### Immediate Actions (Today)
1. Update immediately
- Navigate to WordPress Dashboard > Plugins
- Search for Funnel Builder
- Install version 3.15.0.3 or later
- Verify the update completed successfully
2. Audit External Scripts
- Go to Settings > Checkout > External Scripts
- Review every script listed—remove anything unfamiliar or suspicious
- Cross-reference against your intentionally configured analytics tools
- If you don't recognize it, delete it
3. Check for signs of compromise
- Review web server logs for unusual requests to /checkout endpoints
- Look for configuration changes in the last 2-4 weeks
- Query payment processor reports for spike in chargebacks or fraud alerts
### Short-Term Actions (This Week)
4. Notify your payment processor
- Inform your Stripe, PayPal, or gateway provider that you may have been compromised
- Request fraud monitoring and transaction reviews
- Ask if they detected suspicious activity in the past 30 days
5. Monitor for fraudulent activity
- Check credit card chargeback and dispute reports
- Contact customers who made high-value purchases if you have any suspicion of compromise
- Implement temporary transaction velocity checks or additional verification
6. Credential review
- Change WordPress admin passwords
- Review plugin access logs and disable unused admin accounts
- Enable multi-factor authentication on all administrative accounts
### Long-Term Actions
7. Implement Web Application Firewall (WAF) rules
- Block public access to checkout configuration endpoints
- Monitor for injection attempts to settings parameters
- Log all configuration changes for audit purposes
8. Plugin security scanning
- Implement security plugins like Wordfence or Sucuri to scan for injected code
- Schedule weekly automated scans
- Review plugin file integrity regularly
---
## HackWire Analysis
This incident epitomizes a critical vulnerability in how WordPress manages third-party plugin security. Funnel Builder isn't a fringe plugin—it's installed on 40,000+ stores, many of them processing thousands of transactions daily. The fact that a single unauthenticated endpoint could expose payment infrastructure highlights a failure at multiple levels: inadequate input validation by the plugin developer, insufficient security hardening by store owners, and insufficient vetting of plugins by the WordPress ecosystem.
What's particularly concerning is the sophistication of the attack delivery. Disguising a skimmer as Google Analytics isn't accidental obfuscation—it's intentional tradecraft designed to survive automated malware detection. This suggests organized, well-funded threat actors (likely Eastern European carding gangs) specifically targeting WooCommerce stores through plugin vulnerabilities.
The timing also matters: this flaw was likely discovered weeks or months before Sansec detected exploitation. How many stores were already compromised before FunnelKit released the patch? Payment card data typically takes 5-10 days to appear on dark web carding markets after theft, so we may not see the full impact until mid-to-late May 2026.
For store owners, the lesson is clear: WordPress plugin updates are not optional maintenance tasks—they're emergency security patches. For the broader ecosystem, this should trigger a conversation about plugin security standards, mandatory vulnerability disclosure timelines, and whether the WordPress.org plugin approval process is sufficient to prevent unauthenticated remote code injection.
— HackWire Editorial
---
## Related Coverage