CVE-2026-39738 is a critical unauthenticated PHP Object Injection vulnerability affecting FunnelKit Automations versions up to and including 3.8.6.1. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.