Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming

A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript code into WooCommerce checkout pages, allowing attackers to steal payment data. The flaw, which currently lacks an official CVE identifier, enables threat actors to hijack sensitive information from unsuspecting customers. According to research published by Sansec¹, the exploitation is ongoing, highlighting the need for immediate attention from WordPress administrators and WooCommerce users. The vulnerability's impact is significant, as it can lead to widespread payment data theft and compromise the security of numerous online stores. This active exploitation underscores the importance of staying informed about emerging threats and taking proactive measures to protect against them, as security developments continue to evolve and reshape the threat landscape, so what matters most to practitioners is prompt patching and monitoring to prevent such exploits.