plugin

Uncanny Automator Pro Vulnerabilities

5 known security issues reported for the Uncanny Automator Pro WordPress plugin. Most recent disclosed Jun 25, 2026.

1 critical 1 high 3 medium

Running Uncanny Automator Pro on your site? Check whether your installed version is affected.

Scan your site free

Uncanny Automator Pro <= 7.3.0.6 - Authenticated (Subscriber+) PHP Object Injection

high

The Uncanny Automator Pro plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 7.3.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the...

CVSS:
7.5
Affected:
up to 7.3.0.6
Fixed in:
7.3.0.7
Disclosed:
Jun 25, 2026

CVE-2026-56057 on NVD →

Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor

critical

The Uncanny Automator Pro plugin for WordPress contains a backdoor in all versions up to, and including, 7.3.0.5. This is due to plugin's distribution server getting compromised. This made it possible for attackers to access compromised instances.

CVSS:
9.8
Affected:
7.3.0.5 – 7.3.0.5
Fixed in:
7.3.0.6
Disclosed:
Jun 16, 2026

CVE-2026-12375 on NVD →

Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting

medium

The Uncanny Automator Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...

CVSS:
6.1
Affected:
up to 5.3
Fixed in:
5.3.0.1
Disclosed:
Jul 11, 2024

CVE-2024-37117 on NVD →

Uncanny Automator Pro < 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset

medium

The Uncanny Automator Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a function in all versions up to 5.3.0.1 (exclusive). This makes it possible for unauthenticated attackers to reset the plugin's license settings.

CVSS:
5.3
Affected:
up to 5.3.0.1
Fixed in:
5.3.0.1
Disclosed:
Jun 28, 2024

CVE-2024-37119 on NVD →

Uncanny Automator Pro < 5.3.0.1 - Cross-Site Request Forgery to License Setting Reset

medium

The Uncanny Automator Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 5.3.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to reset the license settings via a forged request granted they can trick a site...

CVSS:
4.3
Affected:
up to 5.3.0.1
Fixed in:
5.3.0.1
Disclosed:
Jun 28, 2024

CVE-2024-37118 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database