Critical Funnel Builder WordPress Plugin Vulnerability Exploited in Payment Card Skimming Attacks A severe, unpatched vulnerability in the Funnel Builder WordPress plugin used by over 40,000 websites to customize WooCommerce checkout pages is being actively exploited to inject malicious JavaScript into e-commerce sites. The flaw, which requires no authentication, affects all versions of the plugin prior to 3.15.0.3. Security firm Sansec discovered the attacks, where threat actors exploit an unprotected checkout endpoint to modify the plugin’s global settings. This allows them to insert arbitrary code into the "External Scripts" field, executing malicious payloads on every checkout page. The injected script disguised as a fake Google Tag Manager/Analytics file (analytics-reports[.]com/wss/jquery-lib.js) establishes a WebSocket connection to an attacker-controlled server (wss://protect-wss[.]com/ws). The payload delivers a customized payment card skimmer, harvesting sensitive customer data, including: - Credit card numbers - CVVs - Billing addresses Stolen payment details are typically used for fraudulent transactions or sold on dark web carding markets. FunnelKit, the plugin’s developer, released a patch (version 3.15.0.3) on June 10, 2024, acknowledging the issue in a security advisory and urging users to update immediately. The vendor also advised administrators to review the Settings > Checkout > External Scripts section for unauthorized entries.