FunnelKit Automations CVE-2026-39738

Prerequisite: a WordPress site running FunnelKit Automations (plugin slug wp-marketing-automations) at version 3.8.6.1 or earlier, with a reachable input that the plugin deserializes. Per PR:N/UI:N/AV:N, no authentication or user interaction is required and the flaw is network-reachable. The key LIMITING factor, inherent to PHP Object Injection, is that achieving the rated C:H/I:H/A:H impact typically requires a suitable POP gadget chain to be present in the plugin, WordPress core, or another installed plugin/theme; the available sources do not describe the specific trigger or confirm which gadget chain realizes code execution, so impact beyond object injection itself is not evidenced here. Exploitation is bounded to installations within the affected version range.

Multiple signals point the same direction here, with one important caveat about mechanism. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and PR:N confirms this is reachable by unauthenticated remote attackers. CWE-502 (deserialization) plus the 'PHP Object Injection' label indicates attacker-controlled serialized data reaches a PHP unserialize sink. The vuln.today Decision label is act_now and the finding is attributed to Patchstack, a credible WordPress vulnerability source, so urgency is high. However, two gaps temper the picture: no EPSS score is provided, so statistical exploitation probability cannot be stated, and no KEV listing or working PoC is present - the only reference is a Patchstack database advisory, not verified exploit code. There is also a mechanism caveat intrinsic to PHP Object Injection: the real-world confidentiality/integrity/availability impact usually depends on a usable POP gadget chain being present in the plugin or co-installed code; the available sources do not describe which gadget chain (if any) achieves the rated C:H/I:H/A:H impact, so the 9.8 should be read as the worst-case ceiling rather than independently confirmed end-to-end RCE. Net: treat as a genuine high priority given act_now, unauthenticated network reach, and a credible reporter - but note exploitation feasibility beyond object injection itself is not evidenced in the provided data.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running FunnelKit Automations 3.8.6.1 or earlier, placing a malicious serialized PHP object into an input that the plugin passes to unserialize(). When deserialized, the object triggers a property-oriented programming (gadget) chain that can lead to site compromise. No public exploit code is identified in the provided data, and the exact trigger and gadget chain are not described in the available sources.