9.1Critical

CVE-2025-3623Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function

uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin Published: 2025-05-14 05:23 (1 year ago)

Description

The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.

Weakness (CWE): CWE-502

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
uncannyowl	uncanny automator	< 6.4.0.2
uncannyowl	Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin	≤ 6.4.0.1

References and patches

CPE matches (NVD) (1)

cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:* < 6.4.0.2

CVSS score

9.1Critical

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

All scores (2)

cna	CVSS 3.1	9.1Critical
security@wordfence.com	CVSS 3.1	9.1Critical

EPSS (chance of exploitation in 30 days)

0.88%

higher than 60% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: total

Timeline

ID reserved2025-04-15
Published2025-05-14 05:23
Reached IP-DB2026-10-25 00:03
Last updated2026-06-17 12:20

Assigned by (CNA): Wordfence
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-127048 3 hours ago

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…

Unscored

CVE-2026-124673 3 hours ago

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclo…

Unscored

CVE-2026-124671 3 hours ago

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather th…

Unscored

CVE-2026-123707 3 hours ago

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

WPGraphQL

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

Unscored

CVE-2026-114452 3 hours ago

Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR

Membership Plugin

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and …

Unscored

CVE-2026-114451 3 hours ago

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

Membership Plugin

The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6…