What is the CVSS score of CVE-2026-56057?

CVE-2026-56057 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Uncanny Automator Pro are affected by CVE-2026-56057?

Uncanny Automator Pro WordPress plugin (versions through 7.3.0.6) contains a critical PHP object injection vulnerability that allows low-privileged Subscriber users to execute arbitrary code and…

How to fix or mitigate CVE-2026-56057?

Within 24 hours: Identify all affected Uncanny Automator Pro installations (versions ≤7.3.0.6); disable the plugin immediately if not business-critical or restrict Subscriber role creation and access. Within 7 days: Deploy network-level monitoring for suspicious serialized object patterns and review subscriber account activity logs for anomalies. Within 30 days: Monitor vendor advisories for patch release; evaluate alternative automation plugins as long-term mitigation.

Uncanny Automator Pro CVE-2026-56057

EUVD-2026-39711 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-26 audit@patchstack.com

GHSA-w4mw-v6cc-cc72

PHP WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Title scopes exploitation to authenticated Subscriber accounts, so PR:L not PR:N; remote network sink with low complexity and unsafe deserialization yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:00 vuln.today

DescriptionCVE.org

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Articles & Coverage 2

News 8 New PHP Vulnerabilities - 2 Critical, 6 High, 1 With POC Jun 27, 2026 News Critical PHP Object Injection in Uncanny Automator Pro WordPress Plugin - CVE-2026-56057 Jun 26, 2026

AnalysisAI

PHP Object Injection in the Uncanny Automator Pro WordPress plugin (versions <= 7.3.0.6) allows authenticated users holding only the low-privileged Subscriber role to inject crafted serialized PHP objects into an unsafe deserialization sink (CWE-502). Depending on the gadget chains present in the plugin or co-installed software, this can escalate to remote code execution, arbitrary file operations, or database tampering. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the input-supplied CVSS of 9.8 likely overstates privileges since the title explicitly scopes the flaw to the Subscriber role.

Technical ContextAI

Uncanny Automator Pro is a no-code automation/recipe plugin for WordPress that connects triggers and actions across sites and third-party services. The root cause is CWE-502 (Deserialization of Untrusted Data): user-controllable input is passed to PHP's unserialize() without validation, allowing an attacker to instantiate arbitrary PHP objects. By itself this is 'object injection'; real impact requires a POP (Property-Oriented Programming) gadget chain - magic methods such as __wakeup(), __destruct(), or __toString() in the plugin, WordPress core, or other installed plugins - to convert object instantiation into file writes, SQL queries, or code execution. No CPE strings were provided in the input; affected scope is derived solely from the Patchstack/NVD version statement.

RemediationAI

No vendor-released patch version was included in the provided data, so no fixed release can be independently confirmed here; consult the Patchstack advisory (URL above) for the patched version and upgrade to the first release above 7.3.0.6 once published. As compensating controls until patched: restrict who can reach the vulnerable functionality by disabling open user registration (Settings → General → 'Anyone can register') so attackers cannot trivially obtain a Subscriber account - trade-off is blocking legitimate self-service signups; deploy a WAF rule (e.g., Patchstack/virtual patching) to block serialized-object payloads (strings matching patterns like 'O:<n>:' or '__PHP_Incomplete_Class') in requests to the plugin's endpoints; and audit/remove unnecessary plugins to shrink the available POP gadget surface. If the plugin is non-essential, deactivating it fully removes exposure.