Live › vulnerability › CVE-2026-39738
FunnelKit Automations, a WordPress plugin, deserializes attacker-supplied PHP objects without authentication in versions up to 3.8.6.1. An attacker who can send crafted requests to the site may be able to run code or change data on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Any WordPress site running the FunnelKit Automations plugin (wp-marketing-automations) at 3.8.6.1 or older, usually WooCommerce stores using abandoned cart capture. Unauthenticated visitors can submit checkout field values that are later deserialized when the contact is loaded. The plugin itself has no known exploit chain, so real impact (file deletion, data theft, code execution) depends on another installed plugin or theme providing a gadget chain. Sites without this plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-marketing-automations | wordpress | <= 3.8.6.1 | 3.8.6.2 |
Update FunnelKit Automations (wp-marketing-automations) to 3.8.6.2 or later (released 2026-10-28).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-39738")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.