Broken Authentication Vulnerability in FunnelKit Automations by FunnelKit
CVE-2026-39450

7.1HIGH

Key Information:

Vendor

WordPress
Status
Funnelkit Automations
Vendor
CVE Published:
15 June 2026

What is CVE-2026-39450?

The FunnelKit Automations plugin versions up to 3.7.3 are susceptible to a broken authentication vulnerability. This issue allows attackers to exploit the authentication system, which could lead to unauthorized access to sensitive information. Website owners using these affected versions are strongly encouraged to apply updates or patches to ensure their sites remain secure.

Affected Version(s)

FunnelKit Automations <= 3.7.3

References

https://patchstack.com/database/wordpress/plugin/wp-marke...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman | Patchstack Bug Bounty Program
.