WordPress Funnel Builder Plugin Vulnerability Actively Exploited for Credit Card Theft

Overview

A critical vulnerability within the Funnel Builder WordPress plugin is being actively exploited. Attackers are leveraging this flaw to inject malicious JavaScript into WooCommerce checkout pages, aiming to steal sensitive credit card details from customers. This directly impacts e-commerce platforms utilizing the vulnerable plugin, leading to potential financial fraud and reputational damage.

Technical Analysis

• The vulnerability is identified as a critical flaw within the Funnel Builder plugin for WordPress.
• Exploitation involves injecting malicious JavaScript snippets into legitimate WooCommerce checkout pages.
• The injected scripts are designed to intercept and exfiltrate credit card information entered by customers during the payment process.
• Specific details regarding the vulnerability type (e.g., XSS, arbitrary file upload) or affected version ranges are not publicly detailed in the source, but active exploitation indicates a severe flaw.
• The attack vector targets the client-side browser experience of users interacting with compromised WooCommerce checkout pages.

Detection

• Monitor WordPress file integrity for unauthorized modifications, especially within plugin directories (wp-content/plugins/) or core files, which may indicate initial compromise or script injection.
• Inspect the source code of WooCommerce checkout pages for unexpected or obfuscated JavaScript inclusions, particularly those loading from unusual external domains or containing suspicious data exfiltration patterns.
• Review web server access logs for unusual requests targeting Funnel Builder plugin endpoints or attempts to upload malicious files, which could signify exploitation attempts.
• Implement client-side monitoring (e.g., browser extensions, network proxies) to detect outbound network connections from checkout pages to domains not typically associated with the e-commerce site.
• Utilize Content Security Policy (CSP) headers to restrict script sources on checkout pages, potentially blocking unauthorized script execution.

Mitigations

1. Immediately update the Funnel Builder WordPress plugin to the latest available patched version. Verify the update was successful and that no malicious files remain.
2. Conduct a thorough security audit of the WordPress installation, including the database and file system, to identify and remove any injected malicious code or backdoors.
3. Implement a robust Web Application Firewall (WAF) to detect and block known exploitation patterns, malicious script injections, and suspicious outbound traffic.
4. Regularly back up WordPress sites and databases to facilitate rapid recovery in the event of a compromise.
5. Review and strengthen WordPress security configurations, including strong passwords, least privilege principles, and disabling unnecessary plugins or themes.

References

• https://www.bleepingcomputer.com/news/security/funnel-builder-wordpress-plugin-bug-exploited-to-steal-credit-cards/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059.007 — JavaScript
• T1041 — Exfiltration Over C2 Channel