# CVE-2026-39450: FunnelKit Automations broken authentication in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-39450-funnelkit-automations-broken-authentication-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-39450 · Severity: high · CVSS 7.1 · Published 2026-06-15

FunnelKit Automations, a marketing automation plugin for WordPress, contains a security flaw that allows users with low-level 'Subscriber' accounts to bypass authentication. This could allow an attacker to perform actions intended for administrators, potentially leading to a full takeover of the website. Organizations using this plugin should update to version 3.8.0 immediately to prevent unauthorized access.

Technologies: [FunnelKit Automations](https://junglewise.ai/threats/technologies/funnelkit-automations). Vendors: [FunnelKit](https://junglewise.ai/threats/vendors/funnelkit).

## Quick answers

**Is CVE-2026-39450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39450 being exploited in the wild.

**How severe is CVE-2026-39450?** High severity, with a CVSS score of 7.1, published 15 June 2026.

**Which products and versions are affected?** FunnelKit Automations <= 3.7.3.

**Is there a fix for CVE-2026-39450?** A patch was published on 2026-04-22: Version 3.8.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39450 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39450?** Check whether you run FunnelKit Automations at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FunnelKit Automations (formerly Autonami) versions 3.7.3 and earlier are vulnerable to an authentication bypass (CWE-288). The flaw allows an authenticated user with low-level 'Subscriber' privileges to bypass intended access controls via an alternate path or channel. By exploiting this broken authentication, a malicious actor can execute functions typically reserved for higher-privileged users, which may lead to administrative access or significant service disruption. The vulnerability is remediated in version 3.8.0.

## Affected products

- FunnelKit FunnelKit Automations <= 3.7.3

## Timeline

- 2026-03-17: other: Reported by Jakub Herman
- 2026-04-22: advisory: Initial Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date
- 2026-04-22: patched: Version 3.8.0 released to address the issue

## References

- [https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-7-3-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-7-3-broken-authentication-vulnerability?_s_id=cve)

## Related threats

- [FunnelKit Automations SQL injection in cart handler](https://junglewise.ai/threats/cve-2026-119163-the-funnelkit-automations-email-marketing-automation-and-crm-for)
- [FunnelKit Automations PHP object injection](https://junglewise.ai/threats/cve-2026-39738-unauthenticated-php-object-injection-in-funnelkit-automations-3-8)
- [The FunnelKit Automations , Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is…](https://junglewise.ai/threats/cve-2025-12469-the-funnelkit-automations-email-marketing-automation-and-crm-for)
- [The FunnelKit Automations , Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is…](https://junglewise.ai/threats/cve-2025-12468-the-funnelkit-automations-email-marketing-automation-and-crm-for)