EUVD-2026-48074
GHSA-h2hg-j6rp-6fv9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Requires an authenticated administrator (PR:H) so it is not anonymous access; SQLi exposes database contents (C:H) with limited integrity impact and no scope change since it stays within the site's own database.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
AnalysisAI
SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress administrator account (CVSS PR:H) with access to the Uncanny Automator plugin's admin interface on a site running version 7.3.2 or earlier; the attacker submits malicious SQL through a plugin input that reaches a backend query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) shows a network-reachable, low-complexity issue, but the decisive metric is PR:H - exploitation requires an existing administrator session, which sharply narrows the real-world attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress administrator access - via credential phishing, password reuse, or a lower-trust internal admin abusing their role - opens an Uncanny Automator feature and submits a crafted value that is concatenated into a backend SQL query. Because complexity is low (AC:L) and no user interaction is required, the injected query returns sensitive data such as user password hashes or other plugins' stored API keys directly from the database. … |
| Remediation | Upgrade Uncanny Automator to the vendor-patched release above 7.3.2; the exact fix version was not included in the provided intelligence, so confirm the patched build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-2-sql-injection-vulnerability) and the plugin's WordPress.org changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running Uncanny Automator versions 7.3.2 and earlier, audit administrator account activity logs for unusual database queries, and document infrastructure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Uncanny Automator
View allThe Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6
Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.3. Rated high severity (CVSS 8.8),
Missing authorization in Uncanny Automator for WordPress up to version 6.4.0.2 allows unauthenticated attackers to explo
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl
The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnera
The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today