What is the CVSS score of CVE-2026-39450?

CVE-2026-39450 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.4%.

Which versions of FunnelKit Automations are affected by CVE-2026-39450?

FunnelKit Automations WordPress plugin (versions 3.7.3 and earlier) contains broken authentication allowing subscriber-level users to bypass access controls and modify site data or trigger…

How to fix or mitigate CVE-2026-39450?

Within 24 hours: Disable open subscriber registration if operationally feasible; review subscriber account activity logs for suspicious changes. Within 7 days: Audit all modifications made by subscriber accounts; contact Patchstack and the plugin vendor for patch timeline and interim recommendations; consider disabling FunnelKit functionality if the site is business-critical. Within 30 days: Implement tighter role-based access controls in WordPress to restrict subscriber capabilities; prepare for urgent plugin update or replacement once vendor releases a patched version.

FunnelKit Automations CVE-2026-39450

EUVD-2026-36929 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-15 Patchstack

GHSA-cpw9-rv4g-g54v

WordPress Information Disclosure Funnelkit Automations Wordpress Plugin Aman

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Remote HTTP reach (AV:N), no special conditions (AC:L), subscriber account required (PR:L), no user interaction (UI:N); broken auth lets attackers tamper with automation state (I:L) and disrupt the plugin (A:H), no clear data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:32 vuln.today

DescriptionCVE.org

Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

AnalysisAI

Broken authentication in the FunnelKit Automations WordPress plugin (versions <= 3.7.3) allows authenticated low-privilege users (subscribers) to bypass intended authentication controls, leading to integrity tampering and availability impact on the WordPress site. The flaw is reported by Patchstack and tracked as EUVD-2026-36929, with no public exploit identified at time of analysis and no CISA KEV listing. Given subscriber-level registration is open on many WordPress sites, the practical attack surface is broader than the CVSS 7.1 score alone suggests.

Technical ContextAI

FunnelKit Automations (formerly WP Marketing Automations, slug 'wp-marketing-automations') is a WordPress marketing-automation plugin used to build email/SMS funnels, broadcasts, and CRM-style workflows. The root cause class is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the plugin exposes a code path that performs a security-sensitive action without re-validating the caller's effective role or capability - typical patterns in WordPress plugins include AJAX/REST endpoints registered with 'wp_ajax_' (logged-in users only, no capability check) or REST routes whose 'permission_callback' returns true or only checks is_user_logged_in(). The CPE 'cpe:2.3:a:aman:funnelkit_automations:*' covers all versions through 3.7.3 with no lower bound specified.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade FunnelKit Automations to the latest version above 3.7.3 published on the WordPress.org plugin repository and verify the changelog references this Patchstack report. Until the upgrade is applied, compensating controls include disabling open user registration in WordPress (Settings → General → 'Anyone can register') to remove the subscriber prerequisite - trade-off is blocking legitimate self-service signups; auditing existing subscriber accounts for anomalous activity and forcing password resets; and restricting access to /wp-admin/admin-ajax.php and the plugin's REST routes (typically under /wp-json/) at the WAF or reverse proxy to authenticated administrators where business workflows allow - trade-off is potentially breaking front-end forms that rely on the plugin's AJAX handlers. Refer to https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-7-3-broken-authentication-vulnerability for vendor-confirmed fix details.