A critical security vulnerability impacting the Funnel Builder plugin for WordPress has entered a phase of aggressive exploitation in the wild, specifically targeting WooCommerce environments to facilitate credit card skimming. According to reports from Sansec and The Hacker News, threat actors are leveraging a flaw in the plugin's handling of user-supplied data to inject malicious JavaScript directly into the checkout process. This 'Magecart-style' attack is particularly insidious because it bypasses traditional server-side security measures by executing within the victim's browser. The vulnerability, which currently lacks an official CVE identifier, highlights a persistent weakness in the WordPress ecosystem: the security of third-party plugins that handle sensitive financial workflows. The exploitation involves the injection of a highly obfuscated script that intercepts payment details—including card numbers, CVVs, and billing addresses—before they are encrypted and sent to the legitimate payment processor. This data is then exfiltrated to a series of actor-controlled C2 domains, many of which are hosted on legitimate cloud infrastructure to avoid detection. The technical OSINT signals suggest that this campaign is highly automated, with scanners identifying vulnerable Funnel Builder installations and deploying the payload within seconds. This automation is a direct reflection of the 'AI-on-AI' threat landscape discussed in previous editions, where attackers use machine learning to optimize their scanning and injection routines. For e-commerce operators, the impact is catastrophic, leading to direct financial loss, regulatory fines under CCPA and GDPR, and a total erosion of customer trust. The 'Funnel Builder' incident serves as a stark reminder that the security of an online store is only as strong as its weakest plugin. Organizations must adopt a rigorous supply chain security posture, which includes regular auditing of all third-party code and the implementation of Content Security Policy (CSP) headers to prevent the execution of unauthorized scripts. The lack of a CVE for this active threat also points to a growing friction between researchers and vendors regarding disclosure timelines, a trend also observed in the recent Azure AKS 'silent fix' controversy. As the May 17 deadline for several other major vulnerabilities passes, the WooCommerce skimming campaign stands as a primary example of how localized flaws can be weaponized into systemic threats to the global digital economy.