EUVD-2026-39694
GHSA-ch5x-8v45-x2xp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization gives PR:N/AV:N with full CIA impact, while AC:H reflects the dependency on a reachable POP gadget chain for practical exploitation.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.
Articles & Coverage 1
AnalysisAI
PHP Object Injection in the Uncanny Automator WordPress plugin (versions 7.3.1.2 and earlier) lets unauthenticated remote attackers submit crafted serialized PHP objects that the application deserializes, potentially leading to full WordPress site compromise. The flaw is rooted in unsafe deserialization of untrusted data (CWE-502) and carries high confidentiality, integrity, and availability impact (CVSS 8.1). No public exploit identified at time of analysis and it is not in CISA KEV; the high attack complexity reflects the need for a usable POP gadget chain in the target environment.
Technical ContextAI
Uncanny Automator is a no-code WordPress automation/workflow plugin that links triggers and actions across other plugins and external services. The issue is a classic PHP Object Injection rooted in CWE-502 (Deserialization of Untrusted Data): attacker-controlled input reaches a PHP unserialize() call (or equivalent), allowing instantiation of arbitrary PHP objects. Deserialization alone does not execute code, but combined with a property-oriented programming (POP) gadget chain present in WordPress core, the plugin, or any other installed plugin/theme, the resulting magic-method calls (__wakeup, __destruct, __toString) can be chained to achieve arbitrary file write/delete, SQL injection, or remote code execution. No CPE strings were provided; affected scope is defined by the Patchstack advisory as the plugin codebase at or below version 7.3.1.2.
RemediationAI
Upgrade the Uncanny Automator plugin to the first vendor release above 7.3.1.2; the exact fixed version is not stated in the provided intelligence, so confirm it against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-1-2-php-object-injection-vulnerability?_s_id=cve) before deploying - do not assume a version number. Until patched, compensating controls include deploying a WAF or Patchstack virtual patch to filter requests carrying serialized PHP object markers (such as 'O:' or 'a:' patterns in parameters reaching the plugin), disabling or removing the plugin if its automations are non-essential (trade-off: breaks active workflows and integrations), and auditing other installed plugins/themes to shrink the pool of available POP gadget chains. Because object-injection exploitability depends on co-resident gadgets, removing unused plugins meaningfully lowers risk but is not a guaranteed fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today