Read the docs
TI-2026-69332 Aliases CVE-2026-82627GHSA-fg33-378f-xr8h

PHP object injection in Uncanny Automator lets attackers delete files

Priority LOW 34CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The Uncanny Automator plugin for WordPress is affected in all versions through 7.6.1.1. It deserializes untrusted input (CWE-502), which lets authenticated attackers with Subscriber-level access or higher inject a PHP object when a third-party integration plugin such as PeepSo, MailPoet or WPForms is installed and a recipe stores attacker-controlled trigger meta. A POP chain within the plugin then lets attackers delete arbitrary files on the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Uncanny OwlUncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Includedup to 7.6.1.1—No fix listedCNA
  • Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included VendorUncanny Owl Affected up to 7.6.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Uncanny Automator.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-82627
  2. 2026-10-08 Alias added: GHSA-fg33-378f-xr8h
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-08 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2023-16885 WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2026-40450 WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-85038 Privilege escalation in Uncanny Toolkit for LearnDash WordPress plugin CVSS 3.1CRITICAL 9.8
  • TI-2026-83516 Authentication bypass in Uncanny Toolkit for LearnDash CVSS 3.1CRITICAL 9.8
  • TI-2025-03190 Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function CVSS 3.1CRITICAL 9.1
  • TI-2024-24647 WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Unauthenticated License Settings Reset vulnerability CVSS 3.1CRITICAL 9.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences