Nothing ruins a Tuesday quite like discovering the "Google Analytics" script quietly humming away on your checkout page isn't Google Analytics at all — it's a credit card skimmer wearing a fake mustache. That's exactly the con that just played out across tens of thousands of WooCommerce stores.

A Fake Tracking Script With a Very Real Payday

Researchers at Sansec caught attackers actively exploiting a flaw in Funnel Builder, the FunnelKit plugin running on more than 40,000 WordPress sites, to rewrite the plugin's "External Scripts" setting through an unauthenticated, unprotected checkout endpoint. The injected code disguised itself as a Google Tag Manager script, then quietly opened a WebSocket connection back to an attacker-controlled server that delivered a payment skimmer custom-built for each individual storefront.

The payload went after credit card numbers, CVVs, billing addresses, and other checkout data — lifted straight off legitimate WooCommerce transactions before customers ever hit "submit." FunnelKit shipped a fix in version 3.15.0.3 and is telling site owners to update immediately and manually check Settings > Checkout > External Scripts for anything that doesn't belong there.

The Scary Part Isn't the Bug — It's the Blind Spot

This flaw hadn't even earned an official CVE number when attackers started using it in the wild, which is the uncomfortable reality of plugin-heavy ecommerce: the exploit window can open before the paperwork catches up. And "unauthenticated endpoint with no permission check" is about as basic a mistake as security bugs get — the kind a five-minute code review should catch before it ships to 40,000 checkout pages.

The bigger lesson for anyone running WooCommerce, or any ecommerce stack bolted together from third-party plugins: your attack surface isn't just your own code, it's every plugin, theme, and integration you've ever installed and forgotten about. Skimmers like this thrive precisely because nobody's watching the plugin nobody remembers adding.

Update your plugins like your customers' credit card numbers depend on it — because this week, they literally did.

If you don't know exactly what scripts are running on your checkout page right now, that's a gap worth closing before an attacker closes it for you — grab our free supply-chain security checklist.

Source: BleepingComputer