FunnelKit Automations: untrusted deserialization (CVE-2026-39738)
A deserialization of untrusted data vulnerability allowing Object Injection (PHP Object Injection) was found in the WordPress plugin FunnelKit Automations (wp-marketing-automations). Its CVSS score is 9.8.
Checked in Shield: no
Who is affected
FunnelKit Automations versions up to and including 3.8.6.1 are affected. This applies to WordPress sites that have the plugin installed.
How to check
In the WordPress admin panel, open the Plugins section and find FunnelKit Automations. If the installed version is 3.8.6.1 or lower, the site falls under the vulnerability description.
How to fix
A fixed version is not stated in the description. Watch for plugin updates from the developer and in the WordPress directory, and apply the patch as soon as it is released.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and any exploitation in the wild are not disclosed yet. Source: NVD, CVE-2026-39738.
