CVE-2026-39440 FunnelForms Fix

A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution (CVE-2026-39440, CVSS 9.9).

The Vulnerability

Root Cause

The af2_demoimport AJAX handler (admin/menu_ajax_functions/demoimport.php) has two fatal flaws:

1. unserialize() on Attacker-Controlled Data

$jsonFile = file_get_contents( $imp_exp_tmp_path . 'af2_export.txt' );
$toImport = unserialize( urldecode( $jsonFile ) );

A crafted ZIP file containing a malicious af2_export.txt triggers PHP Object Injection at deserialization — leading to full Remote Code Execution.

2. Path Traversal via $_POST['filename']

$filename = $_POST['filename'];
$file = pathinfo( AF2_PLUGIN_DIR . '/demos/' . $locale . '/' . $filename . '.zip' );

No basename(), no whitelist. An attacker supplies ../../../uploads/evil and pulls an arbitrary ZIP from outside the demos/ directory.

Missing Security Controls

• No nonce verification
• No capability check
• No input sanitization

An authenticated user with minimal (Subscriber) privileges can exploit this chain.

Installation

As a Regular Plugin (Recommended)

1. Download or clone this repository
2. Upload the cve-2026-39440-funnelforms-fix folder to wp-content/plugins/
3. Activate it in Plugins → Installed Plugins

As an MU-Plugin (Alternative)

Copy cve-2026-39440-fix.php directly to wp-content/mu-plugins/. No activation needed — MU-Plugins load automatically.

What This Plugin Does

The vulnerable code path is never executed. wp_send_json_error() calls wp_die() internally, so the plugin's handler is never reached.

Verification

After activation:

1. The "Demo import" menu item should no longer appear under Funnelforms
2. Any request to admin-ajax.php?action=af2_demoimport returns:
   root@kitploit:~

   {
       "success": false,
       "data": { "message": "Demo import is temporarily disabled for security reasons (CVE-2026-39440)." }
   }
   

When to Remove

This plugin can be deactivated and deleted once FunnelForms Pro releases an official patched version (> 3.8.1) that:

• Replaces unserialize() with json_decode() or implements a strict allowlist
• Sanitizes the filename parameter (basename(), allowlist of known demos)
• Adds nonce verification and capability checks

Credits

• Discovered & reported by: 3ele / Sebastian Weiss
• Published via: Patchstack

License

GPL v2 or later