9.8Kritisch

CVE-2026-39738WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability

Aman FunnelKit Automations Veröffentlicht: 2026-10-30 21:30 (vor 6 Tagen)

Beschreibung

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Aman	FunnelKit Automations	≤ 3.8.6.1

Referenzen und Patches

https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-a… vdb-entry

CVSS-Score

9.8Kritisch

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (2)

cna	CVSS 3.1	9.8Kritisch
audit@patchstack.com	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.41%

höher als 35 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2026-04-07
Veröffentlicht2026-10-30 21:30
Bei IP-DB eingegangen2026-10-30 22:03
Zuletzt aktualisiert2026-11-01 14:18

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

2.2Niedrig

CVE-2026-107776 vor 14 Stunden

Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

Dokan

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less …

9.8Kritisch

CVE-2026-100109 vor 14 Stunden

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

Security For WooCommerce

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…

Ohne Score

CVE-2026-109150 vor 15 Stunden

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

WP PageNavi Style

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is…

Ohne Score

CVE-2026-107773 vor 15 Stunden

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order informatio…

Ohne Score

CVE-2026-107774 vor 15 Stunden

Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly …

Ohne Score

CVE-2026-107775 vor 15 Stunden

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsit…