Security notice

WordPress store using FunnelKit Automations? A flaw rated 9.8 needs no login. Update to 3.8.6.2.

What happened

• The flaw. The CVE record describes it as an "Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions." In plain words, the plugin can be made to accept data it should not trust and turn it into code objects, and no account is needed to try. Patchstack says attackers can use this to "run harmful actions on the server." How far an attacker could go in practice can depend on what else is installed on the site, according to security firm IONIX, and the CVE record does not describe a specific attack method. (Patchstack, CVE record, IONIX)
• How serious. The CVE record rates it CVSS 9.8, which is 9.8 out of 10 and critical: reachable over the internet, low complexity, no account and no visitor interaction needed. (CVE record, Patchstack)
• Affected and fixed versions. FunnelKit Automations 3.8.6.1 and earlier. Version 3.8.6.2 is the fixed version. (Patchstack, CVE record)
• The dates. Patchstack says the flaw was reported on October 27, 2026 through its bug bounty program. WordPress.org lists 3.8.6.2 as released on October 28. Patchstack's entry and the CVE record were published on October 30, so the fix came out two days before the public details. A site that updated since October 28 already has it. (Patchstack, CVE record, WordPress.org)
• FunnelKit's changelog. The 3.8.6.2 entry says "[Update Recommended] Hardened data validation across abandoned cart capture and contact fields." It does not name a vulnerability or the CVE. We rely on Patchstack and the CVE record for the statement that 3.8.6.2 fixes this flaw. (WordPress.org)
• No attacks reported yet. CISA KEV does not list it in its version dated October 30, 2026. CISA's assessment attached to the CVE record marks exploitation as "none," and rates the attack as automatable with a total technical impact. cve.now says it tracks no public exploit code. That does not mean it has not been attacked. Patchstack says the flaw is "highly dangerous and expected to become exploited," and that flaws like this are used in mass campaigns against thousands of sites regardless of traffic. (CVE record, cve.now, Patchstack)
• Patchstack customers. Patchstack says it has issued a mitigation rule for its own customers. That is not a replacement for updating. (Patchstack)
• The paid Pro version: not confirmed. Patchstack and the CVE record name only the plugin published on WordPress.org (plugin folder wp-marketing-automations). We found no statement about the paid FunnelKit Automations Pro add-on, so also check your FunnelKit account for Pro updates. (Patchstack, CVE record)

Who should worry

This is about WordPress websites, usually WooCommerce stores, that use the FunnelKit Automations plugin for abandoned cart emails or marketing automation. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

• Your WordPress site uses FunnelKit Automations (it was formerly called Autonami) and is on version 3.8.6.1 or earlier.
• Automatic plugin updates are off on your site, or you are not sure they are on.
• An agency or developer built your store's email automations and you do not know which plugin runs them.
• You run a web agency or host and look after WordPress sites for clients.

If your site does not use FunnelKit Automations, this notice does not apply to you.

What to do now

Do these today.

1. Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "FunnelKit Automations." Note the version number. If it says 3.8.6.2 or higher, you have the fix.
2. Update. Update FunnelKit Automations to 3.8.6.2 or later. Take a backup first. Updating does not change the minimum WordPress or PHP version: WordPress.org lists WordPress 6.5 and PHP 7.4 as the minimums for both 3.8.6.1 and 3.8.6.2. (Patchstack, WordPress.org)
3. If you cannot update today, ask your developer or host whether to deactivate the plugin until you can. That is general precaution, not FunnelKit's advice, and your automated emails will stop while it is off. (IONIX)
4. Check for a break-in. No signs of attack have been published, so there is nothing specific to look for. As a general check, especially if you were on 3.8.6.1 or earlier for several days, ask your developer or host to look for administrator accounts you do not recognize, plugins you did not install and PHP files you did not put there.
5. If you use FunnelKit Automations Pro, check your FunnelKit account for updates to it as well.
6. Check your site afterwards. Test your abandoned cart emails and your checkout.

What to send your developer, agency or host

FunnelKit Automations (wp-marketing-automations) 3.8.6.1 and earlier has an unauthenticated PHP object injection flaw, CVE-2026-39738 (CVSS 9.8, assigned by Patchstack, published October 30, 2026). It is fixed in 3.8.6.2, released October 28. CISA does not list it as exploited, but Patchstack expects attacks. Please tell us whether our site runs this plugin and which version. If it is 3.8.6.1 or earlier, please update to 3.8.6.2 or later today, and tell us if you checked for unfamiliar administrators, plugins or PHP files. Sources: Patchstack, the CVE record, WordPress.org.

Common questions

Sources

• Patchstack: WordPress FunnelKit Automations Plugin <= 3.8.6.1 is vulnerable to a high priority PHP Object Injection, October 30, 2026, checked October 31, 2026
• CVE Program: CVE-2026-39738, published October 30, 2026 by Patchstack, checked October 31, 2026
• cve.now: CVE-2026-39738, checked October 31, 2026
• WordPress.org: FunnelKit Automations plugin page and changelog, version 3.8.6.2, checked October 31, 2026
• CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked October 31, 2026
• IONIX: CVE-2026-39738 summary, checked October 31, 2026