PT-2026-41419 · WordPress · Funnel Builder

Published 2026-05-15 · Updated 2026-06-15 · CVE-2026-42381

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Funnel Builder (affected versions not specified)

Description An SQL injection flaw in the Funnel Builder plugin allows attackers to inject payment skimmers into WooCommerce checkout pages. This issue enables script propagation across all checkout flows and the establishment of WebSocket Command and Control (C2) channels for real-time exfiltration of credit card data. The exploitation occurs via unprotected Funnel Builder endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime egress controls to detect and block data exfiltration patterns.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-42381

Affected Products

Funnel Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42381 · Security Note
• https://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-15-0-1-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/aviatrixtrc/status/2055799617199935989 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2055437292915789919 · Twitter Post