The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
References
Configurations
History
12 Aug 2025, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:* | |
| First Time |
Uncannyowl uncanny Automator
Uncannyowl |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | () https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve - Third Party Advisory |
14 May 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-14 03:15
Updated : 2025-08-12 01:55
NVD link : CVE-2025-4520
Mitre link : CVE-2025-4520
JSON object : View
Products Affected
uncannyowl
- uncanny_automator
CWE
CWE-862
Missing Authorization