TLDR Tech / InfoSec
Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming
Sansec disclosed an unauthenticated flaw (no CVE) in the FunnelKit Funnel Builder WordPress plugin before 3.15.0.3, affecting 40,000+ WooCommerce stores, where a publicly exposed checkout endpoint failed to check caller permissions or restrict invokable internal methods, letting attackers write attacker-controlled JavaScript into the plugin's global "External Scripts" setting and inject a fake Google Tag Manager loader on every checkout that opens a WebSocket to wss://protect-wss[.]com/ws to retrieve a storefront-tailored card skimmer exfiltrating PANs, CVVs, and billing addresses.
Read the full story