CVE-2026-39738

{
  "etk_id": "ETK-2026-3105",
  "cve_id": "CVE-2026-39738",
  "display_id": "CVE-2026-39738",
  "ghsa_id": "GHSA-9cg4-h688-392x",
  "euvd_id": "EUVD-2026-114288",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated PHP object injection in FunnelKit Automations",
  "summary": "FunnelKit Automations through version 3.8.6.1 is affected by an unauthenticated PHP object injection flaw. An unauthenticated remote attacker may be able to trigger unsafe object handling where an affected plugin installation is publicly reachable.",
  "mitigation": "Disable FunnelKit Automations on publicly reachable sites, or restrict access to the affected WordPress installation, until a vendor-confirmed fixed release is available. Apply that release promptly after confirming it addresses this issue.",
  "vendor": "FunnelKit",
  "product": "FunnelKit Automations",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 3.8.6.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "wp-marketing-automations",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.00934495,
  "t0_at": "2026-10-30T18:30:34.923000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-30T19:18:11.580923+00:00",
      "days": 0.033063170405092594,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T18:30:34.923000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-30T18:30:34.923000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T18:30:34.923000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39738"
    }
  }
}