CVE-2026-82627
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
Risk Assessment
The risk includes the possibility of arbitrary file deletion on the server by an authenticated attacker, potentially leading to system integrity and service availability compromise.
Recommendation
Immediately update the Uncanny Automator plugin to a version newer than 7.6.1.1 and restrict user privileges to the minimum required level.
Other vulnerabilities in Uncanny Automator
See all- CVE-2026-15025High
The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.
- CVE-2026-65462High
The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.
- CVE-2026-15008High
The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.
Original NVD description (English source)
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS