9.8Kritik

CVE-2026-39738WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability

Aman FunnelKit Automations Yayım: 2026-10-30 21:30 (6 gün önce)

Açıklama

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Aman	FunnelKit Automations	≤ 3.8.6.1

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-a… vdb-entry

CVSS puanı

9.8Kritik

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

cna	CVSS 3.1	9.8Kritik
audit@patchstack.com	CVSS 3.1	9.8Kritik

EPSS (30 günde istismar olasılığı)

0.41%

tüm CVE'lerin %35'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-04-07
Yayımlandı2026-10-30 21:30
IP-DB'ye ulaştı2026-10-30 22:03
Son güncelleme2026-11-01 14:18

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

Puansız

CVE-2026-118167 1 saat önce

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

MC4WP: Mailchimp for WordPress

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…

Puansız

CVE-2026-118186 1 saat önce

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…

Puansız

CVE-2026-118187 1 saat önce

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of tha…

Puansız

CVE-2026-118188 1 saat önce

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…

Puansız

CVE-2026-118239 1 saat önce

AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

AutomatorWP

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert …

Puansız

CVE-2026-110813 1 saat önce

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

Advanced Custom Fields (ACF®)

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute na…