CVE-2026-39738 Details
Description
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
A vulnerability allowing unauthenticated PHP object injection has been identified in the FunnelKit Automations WordPress plugin, affecting versions through 3.8.6.1. This type of vulnerability can be exploited to manipulate how the site processes data, potentially leading to harmful actions on the server.
Users are advised to update the FunnelKit Automations plugin to version 3.8.6.2 or later. Patchstack has also issued a mitigation rule to block attacks until the plugin is updated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FunnelKit Automations | <= 3.8.6.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 1, 2026 | CVE Modified | [email protected] |
| Oct 30, 2026 | New CVE Received | [email protected] |
| Oct 30, 2026 | CVE Modified | CISA-ADP |