{"id":"CVE-2026-39738","published":"2026-10-30T19:18:24.427","lastModified":"2026-10-30T19:22:27.173","description":"Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-6-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability is an unauthenticated PHP object injection flaw in FunnelKit Automations versions up to and including 3.8.6.1, allowing attackers to inject malicious serialized PHP objects without authentication, leading to remote code execution or data manipulation.","exploitability":"Exploitation is straightforward for remote attackers due to the lack of authentication requirements and low attack complexity.","blast_radius":"Successful exploitation could lead to full system compromise including unauthorized access to sensitive data, modification of application behavior, or complete server takeover.","remediation":"Upgrade to FunnelKit Automations version 3.8.6.2 or later, which contains a fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["php-object-injection","unauthenticated","rce","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:47:08.937Z"}}