Missing Authorization in Funnel Builder for WooCommerce Checkout by FunnelKit
CVE-2026-47100
8.7HIGH
What is CVE-2026-47100?
The Funnel Builder for WooCommerce Checkout plugin, prior to version 3.15.0.3, is affected by a missing authorization vulnerability in its public checkout endpoint. This flaw allows unauthenticated attackers to exploit internal methods, potentially writing arbitrary data to the plugin's External Scripts global setting. By injecting malicious JavaScript through this setting, attackers can execute harmful scripts in the browsers of all visitors on the checkout page, posing significant security risks.
Affected Version(s)
Funnel Builder for WooCommerce Checkout 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.