EUVD-2026-39711
GHSA-w4mw-v6cc-cc72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber account on target
-
DeliveryCraft malicious serialized PHP object
-
ExploitSubmit payload to vulnerable plugin endpoint
-
Executionunserialize() instantiates attacker object
-
PersistPOP gadget chain triggers on deserialization
-
ImpactAchieve code execution or file write
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account at the WordPress Subscriber role (the lowest standard role) - this is the explicit prerequisite stated in the vulnerability title, contradicting the input vector's PR:N. The target must run Uncanny Automator Pro version 7.3.0.6 or earlier. Meaningful impact (code execution/file write) additionally requires a usable PHP POP gadget chain present in the plugin, WordPress core, or another installed component; object injection without a gadget may be limited. Key limiting factor: on sites that disable open registration, an attacker must first obtain valid Subscriber credentials, substantially narrowing real-world exploitability. |
| Impact | Signals conflict and should be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) claims no privileges required, but the vulnerability title explicitly states 'Subscriber PHP Object Injection,' indicating at least Subscriber-level authentication is needed - so PR:N appears incorrect and PR:L is more defensible (lowering the realistic base score to ~8.8). No EPSS score, KEV entry, or POC was provided: there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical severity also hinges on a usable POP gadget chain, which is environment-dependent (other installed plugins). Net assessment: genuinely high-risk where untrusted users can self-register as Subscribers (open-registration sites), but lower for sites that restrict account creation; treat as an important patch rather than an emergency unless your site allows public registration. |
| Exploit ScenarioDerived | An attacker registers (or already holds) a Subscriber account on a WordPress site running Uncanny Automator Pro <= 7.3.0.6, then submits a crafted serialized PHP object to a plugin parameter that is passed to unserialize(). If a suitable gadget chain exists among the installed plugins, the injected object triggers attacker-chosen behavior on deserialization - potentially writing a webshell or executing code. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
PHP Object Injection in the Uncanny Automator Pro WordPress plugin (versions <= 7.3.0.6) allows authenticated users holding only the low-privileged Subscriber role to inject crafted serialized PHP objects into an unsafe deserialization sink (CWE-502). Depending on the gadget chains present in the plugin or co-installed software, this can escalate to remote code execution, arbitrary file operations, or database tampering. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the input-supplied CVSS of 9.8 likely overstates privileges since the title explicitly scopes the flaw to the Subscriber role.
RemediationAI
No vendor-released patch version was included in the provided data, so no fixed release can be independently confirmed here; consult the Patchstack advisory (URL above) for the patched version and upgrade to the first release above 7.3.0.6 once published. As compensating controls until patched: restrict who can reach the vulnerable functionality by disabling open user registration (Settings → General → 'Anyone can register') so attackers cannot trivially obtain a Subscriber account - trade-off is blocking legitimate self-service signups; deploy a WAF rule (e.g., Patchstack/virtual patching) to block serialized-object payloads (strings matching patterns like 'O:<n>:' or '__PHP_Incomplete_Class') in requests to the plugin's endpoints; and audit/remove unnecessary plugins to shrink the available POP gadget surface. If the plugin is non-essential, deactivating it fully removes exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Uncanny Automator Pro is a no-code automation/recipe plugin for WordPress that connects triggers and actions across sites and third-party services. The root cause is CWE-502 (Deserialization of Untrusted Data): user-controllable input is passed to PHP's unserialize() without validation, allowing an attacker to instantiate arbitrary PHP objects. By itself this is 'object injection'; real impact requires a POP (Property-Oriented Programming) gadget chain - magic methods such as __wakeup(), __destruct(), or __toString() in the plugin, WordPress core, or other installed plugins - to convert object instantiation into file writes, SQL queries, or code execution. No CPE strings were provided in the input; affected scope is derived solely from the Patchstack/NVD version statement.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Title scopes exploitation to authenticated Subscriber accounts, so PR:L not PR:N; remote network sink with low complexity and unsafe deserialization yields high C/I/A.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
Articles & Coverage 2
Executive ViewAI
Uncanny Automator Pro WordPress plugin (versions through 7.3.0.6) contains a critical PHP object injection vulnerability that allows low-privileged Subscriber users to execute arbitrary code and compromise the entire WordPress installation. Organizations relying on this plugin must immediately assess exposure and implement interim controls, as no patch is currently available.
Interim mitigations: Disable Uncanny Automator Pro entirely or restrict Subscriber role creation and access; implement Web Application Firewall rules to detect and block serialized PHP object patterns; establish enhanced logging for administrative functions and database modifications; consider alternative WordPress automation solutions pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB