External risk intelligence

FunnelKit Automations Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-39738

This vulnerability affects a WordPress plugin, which functions as an extension of a web application. Such plugins are commonly used to provide public-facing marketing, automation, and web interaction features, making the associated attack surface frequently accessible via the internet in standard web deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a PHP-based automation tool, potentially allowing unauthorized access and manipulation of systems. While the full impact is still being assessed, the nature of this flaw raises concerns about data integrity and system control. The main concern at this stage is confirming the relevance and exposure of this technology within our environment.

Unauthenticated code injection flaw found in an automation tool.
Critical flaw could lead to unauthorized system access.
Focus on verifying if this tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a vulnerable installation of FunnelKit Automations. Since no authentication is required, this attack could originate from the public internet. If successful, the attacker could inject PHP objects, potentially leading to arbitrary code execution on the server.

Unauthenticated network access required.
Triggered by crafted requests.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in FunnelKit Automations could allow an attacker to remotely execute arbitrary code or influence the application's behavior when specific conditions are met. This could impact the integrity and availability of the affected system.

System integrity and availability.
Via serialized data handling.
Remote code execution or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP object injection vulnerability in FunnelKit Automations affects systems running versions up to 3.8.6.1. Technical leaders and security teams should prioritize identifying all instances of this plugin, confirming their exposure and criticality, and then coordinating with the accountable application or platform owners to schedule remediation. Vendor management teams may also need to engage if the plugin was obtained through a third party.

Application owners should prioritize this issue.
Verify plugin presence and external reachability first.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FunnelKit Automations?

FunnelKit Automations is a WordPress plugin used to build marketing workflows and automate visitor interactions. It runs within a web server environment to manage site engagement tasks, acting as an extension to core WordPress functionality by processing data inputs and triggers for various marketing campaigns.

How does this PHP object injection vulnerability work?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It occurs when the plugin improperly handles serialized PHP objects sent by a user. Because the application processes this data without sufficient validation, an attacker can supply a malicious object that the server then treats as legitimate code, potentially hijacking the application's execution flow.

Do I need to be logged in to trigger this bug?

No. The vulnerability allows for unauthenticated access, meaning an attacker does not need an account or administrative privileges to send the malicious request. It is not triggered by standard site navigation or routine plugin operations, but rather by specifically crafted network requests designed to exploit how the plugin handles serialized data.

How does Halo Surface Signal assess this CVE's relevance?

Halo Surface Signal identifies this as a likely concern because the plugin is typically used for public-facing web interactions. Since WordPress plugins often extend the site's external attack surface, any instance of FunnelKit Automations reachable via the internet is considered a priority for review compared to components restricted to internal-only networks.

What is the first step if I run this software?

The immediate priority is to verify if your organization uses FunnelKit Automations version 3.8.6.1 or earlier. Once identified, evaluate if those specific instances are accessible from the internet. Coordinate with your application owners to plan an update or patch, as the vulnerability resides in how the code manages data, making version control the primary defense.

References

patchstack.com/database/wordpress/plugin/wp-marketing-automations/vu…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.