Another top WordPress plugin exploited — hackers target credit card details, here's what you need to know
- Hackers are exploiting a critical flaw in the Funnel Builder plugin to inject credit card skimmers into checkout pages
- FunnelKit released a patched version, but more than half of active sites remain on older, vulnerable builds
- Stolen payment data is being monetized through dark web sales and fraudulent ad purchases
Hackers are exploiting a critical vulnerability in a popular WordPress plugin to steal credit card information from people making online purchases.
Security researchers Sansec said they recently spotted an active campaign targeting websites running the Funnel Builder plugin, which is apparently active on more than 40,000 ecommerce websites, letting businesses create sales funnels, landing pages, optimized checkout flows, upsells, and lead-generation campaigns, all without any coding.
Sansec found it carried a critical-severity vulnerability (no CVE yet), that allows threat actors to add malicious JavaScript snippets into WooCommerce checkout pages, without authentication. According to the researchers, someone used it to add...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
