CVE-2025-3623criticalCWE-502

CVE-2025-3623: falha crítica em uncannyowl Uncanny Automator – Easy…

Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.9%
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
uncannyowl · Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
CVEs relacionadas — uncannyowl Uncanny Automator – Easy…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2075HIGHUncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 2.8%CVE-2026-15008HIGHUncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field TokenEPSS 1.0%CVE-2026-2269HIGHUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File UploadEPSS 0.7%CVE-2026-15025HIGHUncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX EndpointsEPSS 0.7%CVE-2024-13838MEDIUMUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via WebhookEPSS 0.3%CVE-2025-4520MEDIUMUncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings UpdateEPSS 0.3%