{"id":"CVE-2026-39738","kind":"vulnerability","aliases":["CVE-2026-39738"],"related":[],"title":"FunnelKit Automations: unauthenticated PHP object injection in WordPress plugin","description":"Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.","summary":"FunnelKit Automations, a WordPress plugin, deserializes attacker-supplied PHP objects without authentication in versions up to 3.8.6.1. An attacker who can send crafted requests to the site may be able to run code or change data on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-marketing-automations","fixed":["3.8.6.2"],"affected":"<= 3.8.6.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["funnelkit-automations","package","php","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-3.8.6.2-or-later"],"how_to_check":"- WordPress admin > Plugins: FunnelKit Automations version must be 3.8.6.2 or later.\n- Or read the Version header in wp-content/plugins/wp-marketing-automations/wp-marketing-automations.php.\n- 3.8.6.1 or older is vulnerable.","fix":"Update FunnelKit Automations (wp-marketing-automations) to 3.8.6.2 or later (released 2026-10-28).","status":"open","published_at":"2026-10-30T19:18:24+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:25:42+00:00","updated_at":"2026-10-30T19:26:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T19:25:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FunnelKit Automations: unauthenticated PHP object injection in WordPress plugin","impact":"high","summary":"FunnelKit Automations, a WordPress plugin, deserializes attacker-supplied PHP objects without authentication in versions up to 3.8.6.1. An attacker who can send crafted requests to the site may be able to run code or change data on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","funnelkit-automations","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the web server without logging in","analyst_note":"Check the NVD entry and the plugin vendor's changelog for the fixed version and exploit details: https://nvd.nist.gov/vuln/detail/CVE-2026-39738","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the FunnelKit Automations folder.\n- Confirm whether the installed version is `3.8.6.1` or older.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FunnelKit Automations WordPress plugin at version 3.8.6.1 or earlier are exposed, because the flaw is reachable without logging in. Sites that do not run this plugin are not affected. The sources do not state which configuration options change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":4065,"output_tokens":561,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin vendor's changelog for the fixed version and exploit details: https://nvd.nist.gov/vuln/detail/CVE-2026-39738","search":"'-2026':11A,14A '-39738':12A,15A '3.8.6.1':47B,77C 'abl':60B 'attack':37B,49B 'attacker-suppli':36B 'authent':42B 'autom':2A,22B,31B,76C 'automations':19A 'chang':65B 'code':63B 'craft':53B 'cve':10A,13A 'data':66B 'deseri':35B 'funnelkit':1A,21B,30B,75C 'funnelkit-autom':20B 'inject':6A,73C 'marketing':18A 'may':58B 'object':5A,40B,72C 'packag':23B 'php':4A,24B,39B,71C 'plugin':9A,29B,34B 'request':54B 'run':62B 'send':52B 'server':69B 'site':57B 'suppli':38B 'unauthent':3A,70C 'version':44B,78C 'without':41B 'woocommerc':25B 'wordpress':8A,26B,28B,33B 'wordpress-plugin':27B 'wp':17A 'wp-marketing-automations':16A","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the FunnelKit Automations plugin (wp-marketing-automations) at 3.8.6.1 or older, usually WooCommerce stores using abandoned cart capture. Unauthenticated visitors can submit checkout field values that are later deserialized when the contact is loaded. The plugin itself has no known exploit chain, so real impact (file deletion, data theft, code execution) depends on another installed plugin or theme providing a gadget chain. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39738","severity":null,"published_at":"2026-10-30T19:18:24+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-39738:1192","url":null,"severity":null,"published_at":"2026-10-30T19:26:43+00:00","modified_at":"2026-10-30T19:26:43+00:00","first_seen_at":"2026-10-30T19:26:43+00:00","fetched_at":"2026-10-30T19:26:43+00:00","note":"Fix 3.8.6.2 and mechanism (checkout_fields_data -> contact fields -> maybe_unserialize) come from WPSec WPSEC-2026-1917 and pluginfind changelog, both third-party; vendor changelog not readable, so nothing marked verified. WPSec rates 8.1 (AC:H, no POP chain in plugin) vs Patchstack 9.8; severity left unchanged. No exploitation or PoC found; no social search done (B tier)."}],"documents":[{"id":25495,"url":"https://wpsec.com/vuln/WPSEC-2026-1917/","title":"WPSEC-2026-1917 FunnelKit Automations <= 3.8.6.1 Unauthenticated PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":"Affected: before 3.8.6.2. Fixed 3.8.6.2 (released 2026-10-28). Vector: abandoned cart checkout_fields_data; address/city/postcode saved as CRM contact fields, later maybe_unserialize() on contact load. No known POP chain in the plugin itself; needs a POP chain from another plugin/theme. CVSS 8.1 AC:H.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":25496,"url":"https://wordpress.org/plugins/wp-marketing-automations/","title":"FunnelKit Automations plugin page (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}