FunnelKit Automations CVE-2026-39450

Exploitation requires (1) the target WordPress site to have FunnelKit Automations plugin installed and active at version <= 3.7.3, and (2) the attacker to hold at least a subscriber-level WordPress account on the target site (PR:L) - trivially obtainable where 'Anyone can register' is enabled, otherwise requiring credential acquisition or insider access. No user interaction is required (UI:N) and the attack is delivered over the network to the WordPress HTTP interface (AV:N). Limiting factors: sites that disable open registration and have no compromised low-privilege accounts are not exposed; the specific vulnerable endpoint and any non-default plugin configuration prerequisites are not disclosed in the provided description and should be confirmed via the Patchstack advisory.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H indicates a remotely reachable, low-complexity bypass requiring only a subscriber-level account, with no confidentiality impact but low integrity and high availability impact - consistent with an attacker tampering with automation/workflow state or deleting/disrupting funnels. No EPSS score, KEV listing, or POC is referenced in the input, so exploitation is not confirmed in the wild. However, two signals raise the real-world priority above raw CVSS: WordPress sites frequently allow open subscriber registration, effectively collapsing PR:L toward PR:N for many deployments; and the 'Information Disclosure' tag in the input partially conflicts with the CVSS C:N rating - this discrepancy should be verified against the Patchstack advisory, as the tag may indicate a secondary disclosure pathway not reflected in the scored vector.

An attacker registers a free subscriber account on a target WordPress site running FunnelKit Automations <= 3.7.3 (or uses an existing low-privilege account), then sends a crafted authenticated HTTP request to a plugin AJAX or REST endpoint that fails to enforce capability checks, invoking a privileged automation action such as modifying or deleting funnels, broadcasts, or contact records. The result is integrity tampering of marketing-automation state and disruption of plugin availability for the site owner. No public exploit is identified at time of analysis.