The Uncanny Automator – AI + Automation for WordPress plugin, version 7.6.1.1 and below, is vulnerable to PHP Object Injection. This vulnerability allows authenticated attackers with Subscriber-level access to inject a PHP Object when a third-party integration plugin is installed and a recipe is configured to store attacker-controlled data as trigger meta. The presence of a POP chain within Uncanny Automa [truncated]
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This is due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. The vulnerability can lead to remote code execution when a specific file, such as wp- [truncated]
