A missing authorization flaw in the public checkout AJAX endpoint of Funnel Builder for WooCommerce Checkout allows an unauthenticated attacker to call internal methods and write arbitrary data into the plugin's External Scripts global setting. By injecting malicious JavaScript into this setting, the attacker can make the script execute in the browsers of every visitor to the checkout page, potentially stealing credentials, defacing the site, or delivering phishing payloads. The flaw is a classic example of CWE‑862, where access control checks are omitted for a privileged operation.

The vulnerability affects installations of Funnel Builder for WooCommerce Checkout from FunnelKit that are running any version earlier than 3.15.0.3. No other products or vendors are listed as affected.

The CVSS score of 8.7 indicates high severity, and although the EPSS score is not available, the public nature of the flaw and the lack of authentication requirements suggest a high likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but its impact on all checkout page visitors makes it a critical issue. Attackers can trigger the flaw simply by sending a crafted AJAX request to the public endpoint, after which any visitor’s browser will run the injected script.