CVE-2026-12375: Backdoored Uncanny Automator Pro update enables unauthenticated admin access
TL;DR - Critical supply-chain compromise in Uncanny Automator Pro before 7.3.0.6. - Sites that installed the malicious build should be treated as potentially fully compromised. - Upgrade to 7.3.0.6+, rotate secrets, and perform incident response immediately.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-12375 |
| CVSS score | 9.8 Critical |
| Attack vector | Network |
| Auth required | None |
| Patch available | Yes, upgrade to 7.3.0.6 |
CVE-2026-12375 is a significant WordPress plugin supply chain compromise affecting the Uncanny Automator Pro plugin. This vulnerability stems from a breach in the vendor’s update infrastructure, resulting in the distribution of a backdoored plugin version prior to 7.3.0.6. The malicious code enabled unauthenticated attackers to gain administrator access, leading to potential exfiltration of sensitive information. Therefore, any site that installed the compromised version must be treated as potentially breached.
What Is This Vulnerability?
CVE-2026-12375 is a supply-chain compromise involving the Uncanny Automator Pro plugin from Uncanny Owl. The available source-backed description indicates that the vendor’s update or distribution infrastructure was compromised, and a maliciously modified plugin build was delivered to customers. In practical terms, the plugin package itself became the attack vehicle.
That matters because standard assumptions about trusted updates break down in this case. Administrators may have installed or updated the plugin through what appeared to be a legitimate channel, yet the delivered code included a backdoor. According to the NVD description, the injected code granted unauthenticated attackers an administrator session and beaconed sensitive information, including WordPress secret keys and administrator details, to attacker-controlled servers.
This is materially different from a typical WordPress flaw such as SQL injection, arbitrary file upload, or privilege escalation caused by a coding bug. Here, the root cause is compromise of the software delivery chain, not an application feature behaving insecurely by design. As a result, patching to the fixed version is necessary but may not be sufficient. If a compromised build was installed, defenders should assume follow-on actions such as credential theft, session abuse, persistence, or additional malware deployment are possible.
Available reference material specifically points to version 7.3.0.5 as the malicious release, while the NVD states versions before 7.3.0.6 were affected. The safest defensible interpretation is that 7.3.0.5 is the specifically implicated compromised build and that 7.3.0.6 is the remediation threshold.
Who Is Affected?
The affected product is Uncanny Automator Pro for WordPress, published by Uncanny Owl. The source-backed version statement is that versions before 7.3.0.6 are affected, with 7.3.0.5 specifically identified in the available WPScan reference as the backdoored release delivered through a compromised update server.
If your environment runs Uncanny Automator Pro 7.3.0.5, you should treat that installation as high priority for incident response. If records only show that a site was on a version before 7.3.0.6 and you cannot definitively prove it did not receive the compromised package, the prudent assumption is exposure until proven otherwise. This is especially true for organizations without strong plugin package inventory, file integrity monitoring, or outbound network telemetry.
WordPress site owners, managed hosting providers, agencies maintaining client WordPress estates, and SMBs that rely on automatic or semi-automatic plugin updates are all relevant audiences here. Multi-tenant WordPress fleets are at particular risk because a malicious plugin update can be propagated quickly and may not immediately raise alarms if it appears to come from a trusted vendor channel.
Because the backdoor reportedly provided administrator-level access without authentication, both public-facing sites and internal administrative workflows may have been exposed. Even if only one plugin on one site was affected, downstream impact can include account takeover, web shell deployment, content tampering, credential harvesting, lateral movement through reused credentials, and compromise of other integrated services.
CVSS Score Breakdown
The NVD assigned CVSS 9.8 Critical, but the vector string was not available in the research note. Even without the full vector, that score strongly aligns with the reported behavior: unauthenticated network exploitation leading to high-impact compromise.
A 9.8 score commonly reflects a vulnerability with network attack vector, low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability. In this case, the NVD description states that the malicious code granted unauthenticated administrator sessions and exfiltrated sensitive secrets. That directly supports severe confidentiality and integrity impact. Availability impact is not explicitly described, but administrator-level compromise often implies the attacker could disrupt the site if desired.
The absence of the vector string in the retrieved data means defenders should avoid overstating the exact CVSS component values. Still, the operational takeaway is clear: this is a remotely exploitable, no-auth compromise path with consequences equivalent to full site takeover. For triage and patch prioritization, it should sit in the highest urgency bucket.
A subtle but important point is that CVSS does not fully capture supply-chain trust erosion. A malicious update delivered through a trusted channel can be more damaging in real operations than a traditional critical bug, because it bypasses the normal human skepticism that might otherwise slow exploitation. That is one reason incident response steps are as important as version remediation here.
Exploitation Status
Exploitation is effectively confirmed in the wild by the nature of the CVE description itself. The issue is described as a maliciously distributed plugin build, not merely a theoretical weakness. If a backdoored version was distributed and installed, exploitation capability was already embedded in the software package.
At the time of the provided research, CISA KEV status is false, meaning CVE-2026-12375 is not currently listed in the Known Exploited Vulnerabilities catalog. That should not be read as evidence of low risk. KEV absence only means it was not in that catalog at the time of lookup. In this case, the source-backed description already indicates a real compromise event.
As for public proof-of-concept status, the research note did not identify a separate public PoC repository. That is not unusual for a supply-chain case where the malicious distributed build itself serves as the exploit mechanism. Defenders should state this precisely: a standalone public PoC is not currently confirmed from the provided sources, but the malicious plugin package is the practical attack artifact.
Because no authoritative telemetry counts or vendor incident scope data were provided, it would be inappropriate to claim mass exploitation volume, campaign attribution, or broad internet scanning. In the absence of those details, defenders should assume that any site which installed the compromised build may have disclosed secrets and should investigate accordingly.
How to Detect It
The most reliable first step is asset discovery: identify every WordPress instance running Uncanny Automator Pro and determine whether 7.3.0.5 was ever installed, or whether the site ran any version before 7.3.0.6 during the exposure window. If you cannot reconstruct version history, review backup copies, deployment records, plugin directories, and host-based monitoring data.
Next, look for evidence consistent with the reported behaviors: unauthorized administrator sessions, new or unexpected administrator accounts, secret rotation anomalies, outbound connections from the web tier to unfamiliar destinations, and changes to plugin files that do not match known-good packages. Because the issue included exfiltration of WordPress secret keys and administrator details, defenders should also review whether suspicious password resets, session invalidations, or unusual admin logins occurred after the plugin update.
Technical Notes
Check the installed plugin version directly on disk:
grep -E "^[[:space:]]*\* Version:" /var/www/html/wp-content/plugins/uncanny-automator-pro/uncanny-automator-pro.php
Search WordPress and web server logs for suspicious admin access patterns. Exact artifacts are not authoritatively published in the provided sources, so use these as investigation leads rather than definitive indicators:
# Look for wp-admin access without normal login flow
grep -E 'GET /wp-admin|POST /wp-admin|/wp-login\.php' /var/log/nginx/access.log | tail -n 200
# Look for unexpected admin-ajax activity tied to plugin operations
grep -E 'admin-ajax\.php' /var/log/nginx/access.log | grep -i 'automator\|uncanny'
Example Splunk hunt for suspicious WordPress admin access from new IPs after plugin update activity:
index=web_logs (uri_path="/wp-admin/*" OR uri_path="/wp-login.php" OR uri_path="/wp-admin/admin-ajax.php")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, http_user_agent, uri_path, status
| sort - last_seen
Check for unexpected administrator accounts in WordPress:
SELECT u.ID, u.user_login, u.user_email
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities'
AND m.meta_value LIKE '%administrator%';
If outbound filtering or DNS logs are available, review connections from the WordPress host around the time of plugin installation or update. The provided sources confirm beaconing to attacker-controlled servers but do not publish concrete domains or IP addresses. In the absence of known IOCs, investigate previously unseen destinations contacted by the web server or PHP process.
Mitigation and Patching
The specific fix threshold from the provided sources is Uncanny Automator Pro 7.3.0.6. Any instance running before 7.3.0.6 should be upgraded immediately, and any instance known to have installed 7.3.0.5 should be handled as a likely incident, not just a patching task.
Patching alone is not enough if the compromised build was deployed. Because the backdoor reportedly granted unauthenticated administrator sessions and exfiltrated WordPress secret keys plus administrator details, responders should assume credential and secret exposure. That means rotating WordPress salts, resetting administrator passwords, invalidating sessions, auditing accounts, reviewing plugins and themes for persistence, and checking the filesystem for unauthorized additions.
If you manage multiple WordPress sites, prioritize in this order: internet-exposed production sites, sites with e-commerce or customer data, multi-admin environments, and sites where update provenance cannot be reconstructed. If change-management records are incomplete, err on the side of compromise assessment.
Technical Notes
Upgrade the plugin to 7.3.0.6 or later using your normal trusted management path. If you use WP-CLI and a valid source for the premium plugin package, perform the update through your approved administrative process. Because this is a premium plugin, the exact command may depend on your package distribution method. A generic plugin update workflow looks like this:
wp plugin list | grep uncanny-automator-pro
wp plugin deactivate uncanny-automator-pro
# Install or update using your approved 7.3.0.6+ package source
wp plugin activate uncanny-automator-pro
wp plugin list | grep uncanny-automator-pro
Rotate WordPress salts in wp-config.php after upgrading so stolen keys cannot continue to back attacker sessions:
define('AUTH_KEY', 'replace-with-new-random-value');
define('SECURE_AUTH_KEY', 'replace-with-new-random-value');
define('LOGGED_IN_KEY', 'replace-with-new-random-value');
define('NONCE_KEY', 'replace-with-new-random-value');
define('AUTH_SALT', 'replace-with-new-random-value');
define('SECURE_AUTH_SALT', 'replace-with-new-random-value');
define('LOGGED_IN_SALT', 'replace-with-new-random-value');
define('NONCE_SALT', 'replace-with-new-random-value');
Force password resets for administrators and review current admin users:
wp user list --role=administrator
# Reset individually through your approved process
If an immediate upgrade cannot be performed, the safest temporary workaround is to disable the plugin and restrict administrative access until the site can be remediated. That is operationally disruptive, but safer than continuing to run a potentially compromised build. Because no authoritative vendor workaround beyond upgrading was provided in the source material, do not assume there is a partial configuration fix.
References
The primary source-backed details available for this CVE are limited but sufficient to support urgent defensive action. The NVD description establishes the nature of the compromise, the impact, and the fixed version threshold. The WPScan reference corroborates the plugin version specifically associated with the compromised update server incident.
For more detailed information on related vulnerabilities, you can refer to our articles on CVE-2026-10110 and What is Kubernetes Cluster Security?.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.