FunnelKit Funnel Builder for WooCommerce Checkout up to 3.15.0.3 Public Checkout Endpoint authorization

Summaryinfo

A vulnerability was found in FunnelKit Funnel Builder for WooCommerce Checkout up to 3.15.0.3. It has been rated as critical. Affected is an unknown function of the component Public Checkout Endpoint. This manipulation causes authorization. This vulnerability appears as CVE-2026-47100. The attack may be initiated remotely. In addition, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in FunnelKit Funnel Builder for WooCommerce Checkout up to 3.15.0.3 and classified as critical. Affected by this vulnerability is an unknown function of the component Public Checkout Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

The advisory is shared at sansec.io. This vulnerability is known as CVE-2026-47100 since 05/18/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at sansec.io. It is declared as proof-of-concept.

Upgrading to version 3.15.0.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• E-Commerce Management Software

Vendor

• FunnelKit

Name

• Funnel Builder for WooCommerce Checkout

Version

• 3.15.0.0
• 3.15.0.1
• 3.15.0.2
• 3.15.0.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion