A code injection vulnerability (CVE-2026-39440) has been discovered in FunnelFormsPro plugin by Funnelforms LLC that allows remote code inclusion attacks. The vulnerability affects all versions of FunnelFormsPro from an unspecified starting version through version 3.8.1. This is classified as an 'Improper Control of Generation of Code' vulnerability that enables attackers to execute remote code inclusion attacks. The vulnerability represents a critical security flaw that could allow attackers to execute arbitrary code on affected systems. Organizations using the affected versions of FunnelFormsPro should prioritize patching or mitigation measures.