CVE-2026-39440: Funnelforms FunnelFormsPro Code Injection Leading to Remote Code Inclusion

Overview

CVE-2026-39440 describes an improper control of code generation issue, classified as code injection (CWE-94), in Funnelforms LLC FunnelFormsPro. The published description says it allows remote code inclusion and lists the affected range as from n/a through 3.8.1. The record was published on 2026-04-23 and was assigned by the CNA Patchstack.

Impact

• The vendor-independent CNA assessment rates the issue critical, with a CVSS 3.1 base score of 9.9.
• The vector indicates network attack, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity and availability.
• Because the weakness is code injection with remote inclusion, a successful exploit would likely let an attacker run code in the context of the affected application. This is an inference from the weakness type and the vector, not a statement from the sources.

Affected products and versions

• Product: FunnelFormsPro, from Funnelforms LLC.
• Affected range as published: from n/a through 3.8.1. The lower bound is not stated in a usable form, so the start of the range is unknown.
• The record does not contain structured affected or fixed version data.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS probability is 0.00518 with a percentile of 0.42447, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• The record does not identify a fixed version. The absence of a fixed version in this record does not mean no fix exists; check the vendor and the Patchstack advisory for the current patched release.
• As a general defensive step, inventory every installation of FunnelFormsPro and treat any version within the published range, up to and including 3.8.1, as vulnerable until a vendor fix is confirmed.
• Limit the exposure of administrative and plugin functionality, and restrict who can upload or modify plugin files, while a fix is pending.
• Review the vendor and Patchstack guidance for any interim workaround.

Detection guidance

• Review web server and application logs for unexpected requests that reference external resources or unusual file inclusion parameters.
• Check the file system of the plugin directory for unexpected or recently modified files.
• Monitor for unexpected outbound connections from the web server, which could indicate that included remote content is being fetched.

Limitations of the available information

The record has no title, no structured affected or fixed versions, no vendor advisory text beyond the description, and no proof-of-concept or technical details. The lower bound of the affected range is written as n/a. The source status is marked Deferred. The analysis above relies only on the description, the CVSS data, the CWE classification, the KEV and EPSS fields and one Patchstack reference.

Frequently asked questions

Is CVE-2026-39440 being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

Which versions of FunnelFormsPro are affected?

The published range is from n/a through 3.8.1. The lower bound is not clearly stated, and the record contains no structured version data.

Is there a fixed version?

The record does not identify a fixed version. Check the vendor and the Patchstack advisory for the current patched release.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.