CVE-2026-47100

🗓️ 19 May 2026 14:00:55Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Unauthenticated access in Funnel Builder for WooCommerce Checkout below 3.15.0.3 enables writing External Scripts and injecting JavaScript on checkout.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2026-47100	28 May 202613:42	–	githubexploit
ATTACKERKB	CVE-2026-47100	19 May 202614:00	–	attackerkb
Circl	CVE-2026-47100	20 May 202600:00	–	circl
CNNVD	WordPress plugin Funnel Builder for WooCommerce Checkout 安全漏洞	19 May 202600:00	–	cnnvd
Cvelist	CVE-2026-47100 Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX	19 May 202614:00	–	cvelist
EUVD	EUVD-2026-30936	19 May 202614:00	–	euvd
NVD	CVE-2026-47100	19 May 202615:16	–	nvd
Positive Technologies	PT-2026-41938	19 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47100	5 Jun 202619:21	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2026-47100	14 May 202600:00	–	vulncheck_kev

Vulners

CNA

Node

funnelkit funnel_builder_for_woocommerce_checkoutRange0–3.15.0.3

[
  {
    "defaultStatus": "affected",
    "vendor": "FunnelKit",
    "product": "Funnel Builder for WooCommerce Checkout",
    "repo": "https://wordpress.org/plugins/funnel-builder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThan": "3.15.0.3"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3530797/funnel-builder/tags/3.15.0.3/modules/checkouts/includes/class-wfacp-ajax-controller.php
sansec	www.sansec.io/research/funnelkit-woocommerce-vulnerability-exploited
vulncheck	www.vulncheck.com/advisories/funnel-builder-for-woocommerce-checkout-missing-authorization-via-ajax

Parameter	Position	Path	Description	CWE
post_data	query param	/?wc-ajax=update_order_review	Unauthenticated AJAX endpoint accepts attacker-controlled action update_global_settings_fields, allowing write to _wfacp_global_settings and rendering wfacp_global_external_script leading to stored XSS on checkout pages.	CWE-862

28 Jul 2026 01:48Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00457

SSVC