FunnelKit Automations: unauthenticated PHP object injection (CVE-2026-39738) reported exploited, affects up to 3.8.6.1
Published 03/11/2026 01:58
Timeline
4 events over 2 d
- 01/11/2026First report+1 d 13 h
- 02/11/2026 14:17CorroboratedBSI CERT-Bund (WID)+0 min
- 02/11/2026 14:17ConfirmedBSI CERT-Bund (WID)+11 h
- 03/11/2026 01:58Published on WatchtowerPro CISO
In short
FunnelKit Automations, a WordPress plugin, has a critical flaw (CVE-2026-39738) that lets an unauthenticated attacker inject PHP objects in versions up to 3.8.6.1. VulnCheck reports it is being exploited, though CISA has not listed it. Update to 3.8.6.2 or later, although its changelog does not mention this CVE. Shodan estimates about 1.2 million internet-facing WordPress servers worldwide, 171,447 of them in the EU (03/11/2026); how many run an affected version is not yet known.
How bad is it
Critical. An attacker who can reach a site with this plugin could inject malicious data into it without logging in, which may lead to takeover of the site depending on other code installed.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from patchstack.com, read 03/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- FunnelKit Automations (plugin slug wp-marketing-automations), all versions up to and including 3.8.6.1; the lower bound is not known.
- The plugin has 20,000+ active installations.
What to do now
- Update FunnelKit Automations to 3.8.6.2 or later, the newest release listed on wordpress.org (28/10/2026). Its changelog does not mention this CVE, so it is not confirmed as the fix.
- If you cannot update, deactivate the plugin until you can. This reduces exposure but does not make a server safe.
- Check exposed sites for signs of compromise: unusual admin users, changed plugin or theme files, new PHP files in uploads, and odd requests to the plugin's REST endpoints.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
[NEU] [hoch] WordPress: Schwachstelle ermöglicht Codeausführung CERT · Known exploited (VulnCheck KEV): - Deserialization of Untrusted Data Research · FunnelKit Automations Research