Is CVE-2026-47100 actively exploited?

Yes. CVE-2026-47100 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-47100 be exploited remotely?

Yes. CVE-2026-47100 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-47100?

CVE-2026-47100 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-47100

HIGHCISA KEVIN THE WILD

CVE-2026-47100

CWE-862Published: May 19, 2026· Updated: May 19, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.8th

Official Description

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

NVD Source

Risk Analysis

This high-severity missing authorization vulnerability in Funnel Builder for WooCommerce Checkout allows unauthenticated attackers to inject malicious JavaScript. With a CVSS score of 7.5, this flaw can lead to client-side attacks affecting all checkout page visitors. Its presence in CISA's KEV catalog indicates confirmed active exploitation, making it an urgent concern.

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. It is remotely exploitable without authentication.

Recommended Action

Upgrade Funnel Builder for WooCommerce Checkout to version 3.15.0.3 or later to address this missing authorization vulnerability. Regularly update all plugins and themes to prevent client-side script injection.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-47100 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.

CISA has added CVE-2026-47100 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.