Critical Code Injection Flaw in FunnelFormsPro Exposes Remote Execution Risk

The National Vulnerability Database has detailed a critical ‘Improper Control of Generation of Code’ vulnerability, identified as CVE-2026-39440, within FunnelFormsPro. This flaw, classified under CWE-94, allows remote code inclusion, meaning an unauthenticated attacker could potentially execute arbitrary code on affected systems. The vulnerability impacts FunnelFormsPro versions up to 3.8.1.

With a CVSS score of 9.9, this is a critical vulnerability that demands immediate attention. The attacker’s calculus here is straightforward: exploit a known weakness to gain unauthorized code execution, likely as a stepping stone for further compromise, data theft, or system disruption. Defenders must prioritize patching and validating the integrity of their FunnelFormsPro installations.