CVE-2026-12375
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The uncanny-automator-pro WordPress plugin before version 7.3.0.6 was distributed with malicious code after the vendor's update/distribution infrastructure was compromised. The injected backdoor grants unauthenticated attackers an administrator session on affected sites and exfiltrates secret keys and administrator details to attacker-controlled servers.
Risk Assessment
The organization is at risk of complete takeover of the WordPress site by an unauthenticated attacker, potentially leading to data theft, defacement, or use of the site for further attacks.
Recommendation
Immediately update the uncanny-automator-pro plugin to version 7.3.0.6 or later, then perform a security audit of the site to detect any signs of compromise.
Original NVD description (English source)
The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.