---
id: "CVE-2026-39738"
kind: "vulnerability"
aliases: ["CVE-2026-39738"]
title: "FunnelKit Automations: unauthenticated PHP object injection in WordPress plugin"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-marketing-automations", "fixed": ["3.8.6.2"], "affected": "<= 3.8.6.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["funnelkit-automations", "package", "php", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-3.8.6.2-or-later"]
published_at: "2026-10-30T19:18:24+00:00"
first_seen_at: "2026-10-30T19:25:29+00:00"
updated_at: "2026-10-30T19:26:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39738", "first_seen_at": "2026-10-30T19:25:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:26:43+00:00"}]
---

# FunnelKit Automations: unauthenticated PHP object injection in WordPress plugin

FunnelKit Automations, a WordPress plugin, deserializes attacker-supplied PHP objects without authentication in versions up to 3.8.6.1. An attacker who can send crafted requests to the site may be able to run code or change data on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-marketing-automations affected <= 3.8.6.1 fixed 3.8.6.2

## How to check

- WordPress admin > Plugins: FunnelKit Automations version must be 3.8.6.2 or later.
- Or read the Version header in wp-content/plugins/wp-marketing-automations/wp-marketing-automations.php.
- 3.8.6.1 or older is vulnerable.

## Fix

Update FunnelKit Automations (wp-marketing-automations) to 3.8.6.2 or later (released 2026-10-28).

## Timeline

- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39738
- 2026-10-30T19:26:43+00:00 analyst — Fix 3.8.6.2 and mechanism (checkout_fields_data -> contact fields -> maybe_unserialize) come from WPSec WPSEC-2026-1917 and pluginfind changelog, both third-party; vendor changelog not readable, so nothing marked verified. WPSec rates 8.1 (AC:H, no POP chain in plugin) vs Patchstack 9.8; severity left unchanged. No exploitation or PoC found; no social search done (B tier).

## Documents

- [describes] WPSEC-2026-1917 FunnelKit Automations <= 3.8.6.1 Unauthenticated PHP Object Injection https://wpsec.com/vuln/WPSEC-2026-1917/
- [mentions] FunnelKit Automations plugin page (wordpress.org) https://wordpress.org/plugins/wp-marketing-automations/

## From the sources

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_