Critical
Critical vulnerability in FunnelKit Automations
WordPress
What happened
A serious issue has been identified in FunnelKit Automations that could lead to unauthenticated PHP object injection.
Are you affected?
FunnelKit Automations versions up to 3.8.6.1 may be affected.
What to do now
- Review your version of FunnelKit Automations and upgrade to a fixed version if applicable.
- Monitor for any official patches or updates from Aman.
- Consider additional security measures to mitigate potential risks.
Sources
- cve.now/CVE-2026-39738
- cve.now/GHSA-9cg4-h688-392x
- CVE-2026-39738
- GHSA-9cg4-h688-392x
- https://nvd.nist.gov/vuln/detail/CVE-2026-39738
- https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-6-1-php-object-injection-vulnerability?_s_id=cve
- cve.now/GHSA-9CG4-H688-392X
- GHSA-9CG4-H688-392X
Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.
This product uses data from the NVD API but is not endorsed or certified by the NVD.
Not sure if your app is affected?
Get a free Finish Line Scan and a senior engineer will tell you what to fix.
Get a free scan