Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-19 | 2 | Disclosure2 |
| 2026-05-25 | 1 | Disclosure1 |
| 2026-05-30 | 1 | Patch1 |
| 2026-06-05 | 1 | General1 |
CVE-2026-47100 Funnel Builder for WooCommerce Checkoutの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/03/cve-2026-47100-funnel-builder-for-woocommerce-checkout/ #IT #Security #cybersecurity
Post summary
The article gives an overview of CVE-2026-47100 affecting Funnel Builder for WooCommerce Checkout, explaining the vulnerability and outlining impact and countermeasures including patches or mitigations.
🚨 HIGH: CVE-2026-47100 (CVSS 7.5) Funnel Builder for WooCommerce <3[.]15[.]0[.]3 allows unauthenticated attackers to inject malicious JavaScript on checkout pages via missing authorization flaw. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/AqhYyAoM02
Post summary
The tweet announces a high‑severity vulnerability (CVE‑2026‑47100) in Funnel Builder for WooCommerce that allows unauthenticated JavaScript injection, and urges users to apply the available patch immediately.
WooCommerce Funnel の脆弱性 CVE-2026-47100 が FIX：4万サイト超に決済情報窃取のリスク https://iototsecnews.jp/2026/05/18/critical-funnelkit-vulnerability-puts-40000-woocommerce-sites-at-risk/ 今回の WooCommerce の Funnel Builder プラグインで発生した問題の原因は、プラグイン内にある公開エンドポイントのセキュリティ対策が不十分だったことにあります。本来であれば、システムを操作する前にユーザーの権限を正しく検証し、アクセス制限を行う必要がありますが、それが実施されていませんでした。そのため、未認証の攻撃者からのリクエストにより、設定を更新する内部関数が直接呼び出せる状態になっていました。この欠陥を突く攻撃者により、悪意のスクリプトが追加され、大切な決済データが流出するリスクに繋がってしまいました。ご利用のチームは、ご注意ください。 #CVE202647100 #FunnelBuilder #Vulnerability #Woocommerce
Post summary
An unauthenticated access flaw in WooCommerce Funnel Builder lets attackers trigger internal configuration changes that could leak payment data, affecting more than 40,000 sites; a fix has been announced, but specific patch details are not provided.
CVE-2026-47100 Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated a… https://www.cve.org/CVERecord?id=CVE-2026-47100
Post summary
The excerpt announces a missing authorization flaw in Funnel Builder for WooCommerce Checkout prior to version 3.15.0.3, providing technical details but no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-47100 Unauthenticated Authorization Bypass in Funnel Builder for WooCommerce Checkout Prior to 3.15.0.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47100
Post summary
An unauthenticated authorization bypass flaw exists in Funnel Builder for WooCommerce Checkout versions prior to 3.15.0.3, identified by CVE‑2026‑47100.