Critical Unauthenticated Flaw in Funnel Builder WordPress Plugin Exploited to Inject Payment Skimmers

Executive Summary

A critical unauthenticated vulnerability is being actively exploited in the Funnel Builder plugin for WordPress, impacting more than 40,000 e-commerce websites. The flaw allows attackers to inject malicious JavaScript into the checkout pages of sites using the WooCommerce platform. This injected code functions as a payment skimmer, capturing and exfiltrating sensitive customer data, including credit card numbers, CVVs, and billing information, during the checkout process. The plugin's developer, FunnelKit, has addressed the vulnerability in version 3.15.0.3 and strongly advises all users to update immediately and inspect their sites for signs of compromise.

Threat Overview

The vulnerability represents a significant threat to small and medium-sized businesses that rely on WordPress and WooCommerce for their e-commerce operations. The attack is particularly dangerous for several reasons:

• Unauthenticated Access: The attacker does not need any credentials or prior access to the WordPress dashboard to exploit the flaw.
• Stealthy Payload: The malicious code is disguised as a legitimate Google Tag Manager script, making it less likely to be noticed during a cursory inspection.
• Direct Financial Impact: The attack directly targets payment information, leading to financial fraud, chargebacks, and severe reputational damage for the affected merchants.

This type of attack, often associated with groups like Magecart, involves compromising e-commerce sites to steal payment card data, a practice known as digital skimming or e-skimming.

Technical Analysis

The root cause of the vulnerability is an insecure public-facing checkout endpoint within the Funnel Builder plugin. This endpoint fails to perform proper permission checks, allowing any unauthenticated user to interact with it.

Attack Chain

1. Exploitation: An attacker sends a specially crafted, unauthenticated HTTP request to the vulnerable endpoint.
2. Injection: The request triggers an internal plugin method that is responsible for saving settings. The attacker uses this to write a malicious JavaScript snippet (disguised as a Google Tag Manager script) into the plugin's "External Scripts" configuration, which is stored in the WordPress database.
3. Activation: This malicious script is now globally configured to load on the website. When a customer navigates to the checkout page, the script is loaded and executed by their browser.
4. Skimming: The script monitors the payment form fields. When the customer enters their credit card number, CVV, name, and address, the script captures this data.
5. Exfiltration: The captured data is then sent to a remote, attacker-controlled server.

This attack leverages the T1190 - Exploit Public-Facing Application technique for initial access and T1059.007 - JavaScript for the skimming payload.

Impact Assessment

For the over 40,000 websites using a vulnerable version of the Funnel Builder plugin, the impact is severe:

• Customer Data Breach: All customers who make purchases on a compromised site are at risk of having their payment and personal information stolen.
• Financial Loss: Merchants face significant financial repercussions, including chargeback fees, fines from payment card issuers (PCI DSS non-compliance penalties), and lost revenue.
• Reputational Damage: Trust is paramount in e-commerce. A payment data breach can permanently damage a brand's reputation and drive customers away.
• Cleanup Costs: Removing the infection, notifying customers, and hardening the website against future attacks can be a costly and time-consuming process.

Cyber Observables — Hunting Hints

Security teams and website administrators should hunt for the following indicators:

Detection & Response

• Check Plugin Version: The first step is to navigate to the WordPress dashboard -> Plugins and check the version of the "Funnel Builder by FunnelKit" plugin. If it is below 3.15.0.3, assume you are at risk.
• Inspect External Scripts: Go to the Funnel Builder settings and carefully examine the "External Scripts" section. Look for any scripts you did not add, especially anything that looks like a Google Tag Manager script but seems suspicious. Remove any unauthorized entries.
• Scan for Malicious Code: Use a reputable WordPress security scanner (e.g., Wordfence, Sucuri) to scan your site's files and database for malicious code and backdoors.
• Analyze Network Traffic: Use browser developer tools (Network tab) on your checkout page to see where data is being sent. Look for any POST requests to unknown or suspicious domains when you submit the payment form. This is a form of Outbound Traffic Filtering (D3-OTF).

Mitigation

• Update Immediately: The most important mitigation step is to update the Funnel Builder plugin to version 3.15.0.3 or newer. This patch removes the unauthenticated access vulnerability.
• Web Application Firewall (WAF): A properly configured WAF can help block malicious requests, but it should not be relied upon as the sole defense. It is a good implementation of Inbound Traffic Filtering (D3-ITF).
• Regular Audits: Regularly audit your WordPress plugins, themes, and user accounts. Remove any that are not necessary to reduce your attack surface.
• File Integrity Monitoring: Use a security plugin that monitors your core WordPress files for changes.