The FunnelKit Automations vulnerability affects a plugin for WordPress sites, in versions 3.8.6.1 and earlier, rated 9.8 out of 10 by the reporting organization (CNA), according to the NVD. No exploitation has been reported to date: the useful step this week is finding out whether your site uses this plugin, and which version.
What is it?
A plugin for WordPress sites has a critical flaw, exploitable without an account or password, in versions 3.8.6.1 and earlier.
WordPress is the software that runs a large share of business websites, and a plugin is a module added to it for a specific function. CVE-2026-39738 was published by the National Vulnerability Database on October 30, 2026. It’s a PHP object injection: in plain terms, the plugin receives data from outside and processes it without checking its contents closely enough, which can cause the site to carry out operations that weren’t intended. It’s like closing the cottage for winter: front door locked, shutters up, but the back service door is left ajar, and it opens onto the whole house.
Why is it serious?
Almost the maximum score, for a flaw reachable without any credentials.
The score of 9.8 out of 10 (CVSS 3.1) was assigned by the reporting organization (CNA), according to the NVD record. In business terms, an affected site could mean a frozen online store, a booking system going down, customer contact information exposed, or a payment page redirected toward fraud. No exploitation has been reported to date. This is the case of a storm forecast on the weather report, the kind where there’s still time to bring in the patio furniture. In Quebec, a confidentiality incident involving personal information triggers obligations. Businesses must keep an incident register and, where there is a risk of serious harm, notify the Commission d’accès à l’information (Quebec’s privacy regulator) and the affected individuals.
Who is affected?
FunnelKit Automations, from publisher FunnelKit, in versions 3.8.6.1 and earlier.
The records reviewed, NVD and Patchstack, do not indicate a fixed version: this information is missing, and it’s the publisher who should be asked. This affects businesses whose site runs on WordPress with this plugin installed: online stores, appointment booking, newsletter sending.
How do I check my business?
Find out whether the plugin is installed, which version, and who is tracking it.
- Have someone open the WordPress dashboard to confirm whether FunnelKit Automations is installed and which version is active (IT provider or webmaster).
- Ask the publisher, FunnelKit, whether a fixed version has been released (IT provider).
- Check whether anyone monitors the site’s plugins and keeps access logs, meaning the traces of connections and requests received by the site, useful for looking into suspicious activity (management, with the hosting provider or service contract).
What the FunnelKit Automations Vulnerability Means for Quebec SMBs
The site of an SMB is sometimes entrusted to a freelancer or an agency, without clear responsibility for updates: that’s a situation to verify in your own business rather than a general rule. The issue is therefore less technical than a matter of governance: who updates what, and how often. The Canadian Centre for Cyber Security places patching precisely among its baseline controls for small and medium organizations.
Scenario
Fictional example: an independent garage whose website takes appointments and sells tires online.
The plugin hadn’t been updated in months, and no one had read the security advisory. One morning, the appointment page stops responding and confirmation emails stop going out. The freelancer responsible for the site can’t be reached. The day is spent on the phone: rebooking appointments by hand, notifying customers, wondering whether any contact information was accessed. The garage keeps running, but a day is lost and customer trust takes a hit.
What to do now
- Inventory the plugins installed on your WordPress site, along with their active version.
- Check with FunnelKit whether a fixed version is available.
- Update the plugin as soon as a patch is released, then confirm the version in use.
- Disable the plugin if it isn’t essential, until the patch is applied.
- Specify in your provider’s contract who monitors security advisories and applies updates.
FAQ
Are we too small to be a target?
A flaw exploitable without an account or password doesn’t screen its targets by revenue: it affects any site running an affected version. The real question isn’t your size, but the version installed on your site.
No attacks have been reported, can we wait?
No exploitation has been reported to date, and that’s good news, not a license to wait. A score of 9.8 out of 10 points to a flaw that’s easy to reach and has serious consequences. Take inventory now and apply the patch as soon as it’s released.
Our provider says everything is secure, how should we respond?
Ask for facts rather than assurances: the list of plugins and their versions, the date of the last update, the name of the person tracking security advisories. Be wary of any claim of total protection, since no absolute protection exists and no provider can guarantee zero risk. A good partner talks about reducing exposure.
Sources
- National Vulnerability Database record for CVE-2026-39738 · NIST, October 30, 2026
- Security advisory (patchstack.com) · patchstack.com
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline control checklist
- Commission d’accès à l’information du Québec · obligations, incident register and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-39738
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
