Unsecured Backdoor in Uncanny Automator Pro Plugin for WordPress
CVE-2026-12375
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 July 2026
Badges
What is CVE-2026-12375?
The Uncanny Automator Pro WordPress plugin versions prior to 7.3.0.6 were found to have a critical backdoor that was planted following a compromise of the vendor's update infrastructure. This malicious code allows attackers without authentication to gain administrative access to the affected sites, facilitating unauthorized control. Moreover, it compromises the security of sensitive site data, including secret keys and administrator details, by transmitting them to servers controlled by the attackers. Website owners using vulnerable versions are urged to update immediately to protect their sites from potential exploitation.
Affected Version(s)
uncanny-automator-pro 7.3.0.5 < 7.3.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.