Funnel Builder Plugin Bug Steals Credit Cards

Robert Moore · 2026-05-15

A critical security hole in the popular Funnel Builder plugin for WordPress is being actively exploited right now. Hackers are injecting malicious JavaScript into WooCommerce checkout pages to steal credit card details from unsuspecting customers. If you run an online store using WooCommerce, this is something you need to take seriously. This isn't just another minor bug. It's a full-blown attack that compromises the very moment your customers trust you with their payment info. The injected script captures everything they type into the checkout form—card numbers, expiry dates, CVV codes—and sends it straight to the attackers. No one wants that kind of surprise. ### What's Going On? The vulnerability exists in a plugin called Funnel Builder, which is used by thousands of WooCommerce stores to create sales funnels and optimize checkout flows. The attackers found a way to exploit a flaw in the plugin's code, allowing them to slip in their own JavaScript without the store owner even knowing. Once it's there, it runs silently in the background, grabbing data from every customer who completes a purchase. Think of it like a hidden camera in a bank's ATM lobby. The transaction looks normal, but someone's watching every keystroke. That's what's happening here, except it's digital and much harder to detect.  ### Why This Matters for Your Business If you're running a WooCommerce store, your customers trust you with their financial data. A breach like this doesn't just cost you money—it costs you their trust. And once trust is gone, it's incredibly hard to get back. The attacks are happening now, so you can't afford to wait. - Your customers' credit cards could be stolen without any obvious signs. - The malicious code is designed to be stealthy, so it might not trigger standard security alerts. - Even if you're using other security plugins, this specific vulnerability might slip through.  ### How to Protect Your Store Right Now The good news is that you can take action today to reduce your risk. Here's what you need to do: - Update the Funnel Builder plugin immediately to the latest version. The developers have released a patch that fixes this vulnerability. If you haven't applied it, do it now. - Check your WooCommerce checkout pages for any unfamiliar JavaScript. Look for scripts that don't belong to your theme or plugins. A quick inspection of your site's source code can reveal suspicious entries. - Enable two-factor authentication on your WordPress admin account. This adds an extra layer of protection against unauthorized access. - Consider using a web application firewall (WAF) that can block known malicious patterns. Some WAFs can detect and stop script injections before they reach your customers. > "Security is not a product, but a process. You can't just set it and forget it." This is especially true for e-commerce sites where the stakes are high. Regular updates and vigilant monitoring are your best defenses. ### What About Antidetect Browsers? As an antidetect browser specialist, I often see parallels between these kinds of attacks and the tools we use for privacy. While antidetect browsers are designed to protect your digital fingerprint and prevent tracking, they can't directly stop server-side vulnerabilities like this plugin bug. But they do highlight the importance of layered security. Using a secure browser setup, combined with updated software and good practices, creates a stronger overall defense. If you're a professional managing multiple online accounts or stores, antidetect browsers can help you compartmentalize your activities. That way, if one account gets compromised, the others remain safe. It's not a silver bullet, but it's a smart part of a broader strategy. ### Final Thoughts This Funnel Builder vulnerability is a stark reminder that no plugin is immune to flaws. The attackers are actively exploiting it, so every moment counts. Update your plugin, inspect your site, and stay vigilant. Your customers are counting on you. Remember, the best defense is a proactive one. Don't wait for something to go wrong before you act. Take these steps today, and you'll sleep better knowing your store is a little safer.