Uncanny Automator EUVD-2026-39694

Exploitation requires an unauthenticated, network-reachable request to a Uncanny Automator code path that deserializes attacker-controlled data on a site running version 7.3.1.2 or earlier (per CVSS PR:N/UI:N, no login or victim interaction is needed). The key limiting factor, reflected by AC:H, is that a usable PHP POP gadget chain must exist among the installed WordPress core, plugins, or themes for the object injection to produce meaningful impact such as RCE or file manipulation; on a minimal install lacking suitable gadgets, real-world impact may be reduced. The exact vulnerable parameter/endpoint is not specified in the provided data and should be confirmed via the Patchstack advisory.

Signals are mixed but credible. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1 High) means network-reachable, no authentication, no user interaction, and full CIA impact, but with high attack complexity - which for object injection typically encodes the requirement that an exploitable gadget chain be reachable in the deployed environment. No EPSS score was provided, so exploitation probability cannot be quantified from this data. It is NOT in CISA KEV (no confirmed active exploitation) and no POC was referenced, so this is currently a serious-but-unproven risk rather than confirmed mass exploitation. The combination of unauthenticated network reach and high impact justifies prompt patching, while AC:H and the absence of a public exploit suggest it is not yet a drop-everything emergency. Caveat: the exact data path reaching unserialize() is not disclosed in the provided description - verify the injection vector against the Patchstack advisory before tuning detections.

An unauthenticated attacker crafts a serialized PHP object payload, embedding a POP gadget chain built from classes loaded by WordPress core or installed plugins, and submits it to a plugin endpoint that deserializes attacker input. When unserialize() instantiates the object, the chained magic methods fire to achieve goals such as arbitrary file write or code execution, leading to site takeover. No public POC was referenced, and the high attack complexity means the attacker must first identify a viable gadget chain in the target environment.