Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming

A critical vulnerability in the Funnel Builder WordPress plugin allows unauthenticated attackers to inject malicious JavaScript into WooCommerce checkout pages and steal payment data.

• •Affects 40,000+ WooCommerce stores; actively exploited to inject fake Google Tag Manager scripts
• •Vulnerability in unprotected checkout endpoint lacks permission checks, allowing arbitrary code injection
• •Malicious code connects via WebSocket to C2 server to retrieve payment skimmers; steals credit card data; patched in 3.15.0.3

This summary was automatically generated by AI based on the original article and may not be fully accurate.