Access Control Vulnerability in Uncanny Automator by Uncanny Owl
CVE-2025-48133

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Uncanny Automator
Vendor
CVE Published:
5 June 2025

What is CVE-2025-48133?

A missing authorization vulnerability in Uncanny Automator allows attackers to exploit improperly configured access control settings. This flaw permits unauthorized actions by exploiting the application's reliance on access control security levels, leading to potential data breaches and unauthorized access. The issue affects Uncanny Automator versions up to and including 6.4.0.2, highlighting the importance of stringent access control configurations in plugin development.

Affected Version(s)

Uncanny Automator <= 6.4.0.2

References

https://patchstack.com/database/wordpress/plugin/uncanny-...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Denver Jackson (Patchstack Alliance)
.