Uncanny Automator Ai Automation For Wordpress Ai Agent Ai Page Builder Free Ai Usage Included
Monthly
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.