What is the CVSS score of CVE-2026-65462?

CVE-2026-65462 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Uncanny Automator are affected by CVE-2026-65462?

Organizations running Uncanny Automator WordPress plugin versions 7.3.2 and earlier face data breach risk from insider threats or compromised administrator accounts, with no vendor-released patch…

How to fix or mitigate CVE-2026-65462?

Within 24 hours: identify all systems running Uncanny Automator versions 7.3.2 and earlier, audit administrator account activity logs for unusual database queries, and document infrastructure scope. Within 7 days: mandate multi-factor authentication for all WordPress administrator accounts, deploy database query logging and alerting on administrative SQL activity, and implement role-based access restrictions on plugin administrative functions. Within 30 days: establish a patch readiness plan by monitoring vendor security advisories, evaluate alternative WordPress automation solutions as potential replacements, and prepare an optional decommissioning procedure if the plugin is not critical to business operations.

Uncanny Automator CVE-2026-65462

EUVD-2026-48074 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-h2hg-j6rp-6fv9

WordPress SQLi Uncanny Automator Wordpress Plugin

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

5.5 MEDIUM

Requires an authenticated administrator (PR:H) so it is not anonymous access; SQLi exposes database contents (C:H) with limited integrity impact and no scope change since it stays within the site's own database.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:36 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.6

DescriptionCVE.org

Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

AnalysisAI

SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Uncanny Automator is a no-code automation ('recipe') plugin for WordPress that connects triggers and actions across plugins and external services, executing many database operations against the WordPress MySQL/MariaDB store. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-influenced input reachable from an administrator-facing feature is concatenated into a SQL statement without proper parameterization or escaping. The affected CPE is cpe:2.3:a:uncanny_owl:uncanny_automator, i.e. the Uncanny Owl-authored Automator plugin across all builds up to and including 7.3.2. Because WordPress plugins share the site's single database connection, injected SQL executes with the privileges of the WordPress DB user and can potentially reach tables (wp_users, wp_options, secrets stored by other plugins) beyond the plugin's own data.

RemediationAI

Upgrade Uncanny Automator to the vendor-patched release above 7.3.2; the exact fix version was not included in the provided intelligence, so confirm the patched build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-2-sql-injection-vulnerability) and the plugin's WordPress.org changelog before deploying. Until patched, reduce the administrator attack surface: enforce least privilege so only strictly necessary accounts hold the administrator role, require MFA on all admin logins to prevent the account takeover that would satisfy the PR:H precondition, and audit existing admin users for anomalies. If Patchstack vPatch/virtual patching or a WAF with SQLi rules is available, deploy it in front of the affected admin endpoints (trade-off: signature rules can miss obfuscated payloads and may false-positive on legitimate recipe configuration). Restricting wp-admin access by IP allowlist further limits who can reach the vulnerable feature, at the cost of admin convenience for remote or roaming staff.