Paper/Archive/CVE-2025-3623

CVE-2025-3623

uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin — Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function

EPSS 0.9%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 58.8.588 × 2011.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.

Affected

ProductAffectedFixed inSource

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin≤ 6.4.0.1–CNA

Scores by source

Wordfence (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/00bcfd8f-9785-449a-a0ea-16e2583d684a?source=cve refwordpress.org/plugins/uncanny-automator/#developers refplugins.trac.wordpress.org/browser/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php#L540 refplugins.trac.wordpress.org/changeset/3276577/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php refautomatorplugin.com/knowledge-base/uncanny-automator-changelog/#6-4-0-2-2025-04-18