Uncanny Automator Pro <= 7.3.0.6 - Authenticated (Subscriber+) PHP Object Injection
high
The Uncanny Automator Pro plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 7.3.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the...
- CVSS:
- 7.5
- Affected:
- up to 7.3.0.6
- Fixed in:
- 7.3.0.7
- Disclosed:
- Jun 25, 2026
CVE-2026-56057 on NVD →
Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor
critical
The Uncanny Automator Pro plugin for WordPress contains a backdoor in all versions up to, and including, 7.3.0.5. This is due to plugin's distribution server getting compromised. This made it possible for attackers to access compromised instances.
- CVSS:
- 9.8
- Affected:
- 7.3.0.5 – 7.3.0.5
- Fixed in:
- 7.3.0.6
- Disclosed:
- Jun 16, 2026
CVE-2026-12375 on NVD →
Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting
medium
The Uncanny Automator Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...
- CVSS:
- 6.1
- Affected:
- up to 5.3
- Fixed in:
- 5.3.0.1
- Disclosed:
- Jul 11, 2024
CVE-2024-37117 on NVD →
Uncanny Automator Pro < 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset
medium
The Uncanny Automator Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a function in all versions up to 5.3.0.1 (exclusive). This makes it possible for unauthenticated attackers to reset the plugin's license settings.
- CVSS:
- 5.3
- Affected:
- up to 5.3.0.1
- Fixed in:
- 5.3.0.1
- Disclosed:
- Jun 28, 2024
CVE-2024-37119 on NVD →
Uncanny Automator Pro < 5.3.0.1 - Cross-Site Request Forgery to License Setting Reset
medium
The Uncanny Automator Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 5.3.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to reset the license settings via a forged request granted they can trick a site...
- CVSS:
- 4.3
- Affected:
- up to 5.3.0.1
- Fixed in:
- 5.3.0.1
- Disclosed:
- Jun 28, 2024
CVE-2024-37118 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database