CVE-2026-47100: Missing Authorization in FunnelKit Funnel Builder for WooCommerce Checkout
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
AI Analysis
Technical Summary
CVE-2026-47100 is a missing authorization vulnerability in Funnel Builder for WooCommerce Checkout before version 3.15.0.3. The issue exists in a public checkout endpoint that does not properly restrict access, allowing unauthenticated attackers to call internal methods and modify the External Scripts global setting. This enables injection of arbitrary JavaScript, which executes in the context of the checkout page for all visitors, posing a significant risk of client-side code execution.
Potential Impact
The vulnerability allows unauthenticated attackers to inject malicious JavaScript into the checkout page via the External Scripts setting. This can lead to client-side attacks affecting all users visiting the checkout page, potentially compromising user data or session integrity. The CVSS 4.0 score of 8.7 indicates a high severity impact with network attack vector, no required privileges, and no user interaction needed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's endpoints if possible and monitor for suspicious activity related to script injection. Avoid using affected versions in production environments where possible.
CVE-2026-47100: Missing Authorization in FunnelKit Funnel Builder for WooCommerce Checkout
Description
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47100 is a missing authorization vulnerability in Funnel Builder for WooCommerce Checkout before version 3.15.0.3. The issue exists in a public checkout endpoint that does not properly restrict access, allowing unauthenticated attackers to call internal methods and modify the External Scripts global setting. This enables injection of arbitrary JavaScript, which executes in the context of the checkout page for all visitors, posing a significant risk of client-side code execution.
Potential Impact
The vulnerability allows unauthenticated attackers to inject malicious JavaScript into the checkout page via the External Scripts setting. This can lead to client-side attacks affecting all users visiting the checkout page, potentially compromising user data or session integrity. The CVSS 4.0 score of 8.7 indicates a high severity impact with network attack vector, no required privileges, and no user interaction needed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's endpoints if possible and monitor for suspicious activity related to script injection. Avoid using affected versions in production environments where possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-18T19:22:26.747Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0c757aec166c07b0b402af
Added to database: 5/19/2026, 2:36:42 PM
Last enriched: 5/19/2026, 2:51:44 PM
Last updated: 5/19/2026, 4:02:29 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.