Read the docs
TI-2026-34699 Aliases CVE-2026-47100GHSA-cffp-87j8-rff2

Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

Priority HIGH 77CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00457 39th percentileScored 2026-11-07
Fix Fixed Funnel Builder for WooCommerce Checkout (FunnelKit): 3.15.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FunnelKitFunnel Builder for WooCommerce Checkoutbefore 3.15.0.33.15.0.3Patch availableCNA
  • Funnel Builder for WooCommerce Checkout VendorFunnelKit Affected before 3.15.0.3 Fixed in 3.15.0.3 Patch available CNA

Remediation

  • Fix · CNA Funnel Builder for WooCommerce Checkout (FunnelKit) Fixed in 3.15.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47100
  2. 2026-10-03 Alias added: GHSA-cffp-87j8-rff2

References

Patch 1

Other 1

  • TI-2024-08524 Automation By Autonami < 3.3.0 - Unauthenticated SQLi CVSS 3.1HIGH 8.6
  • TI-2025-01932 WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection CVSS 3.1MEDIUM 6.1
  • TI-2025-01346 Missing authorization in FunnelKit Automations – Email Marketing Automation and CRM for… CVSS 3.1CRITICAL 9.8
  • TI-2026-30681 WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-06987 Information disclosure in FunnelKit Automations – Email Marketing Automation and CRM for… CVSS 3.1HIGH 8.8
  • TI-2025-12949 FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences