CVE-2025-4520: falha de média gravidade em uncannyowl Uncanny Automator – Easy…
Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
uncannyowl · Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder PluginCVEs relacionadas — uncannyowl Uncanny Automator – Easy…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-2075HIGHUncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 2.8%CVE-2026-15008HIGHUncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field TokenEPSS 1.0%CVE-2025-3623CRITICALUncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message FunctionEPSS 0.9%CVE-2026-2269HIGHUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File UploadEPSS 0.7%CVE-2026-15025HIGHUncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX EndpointsEPSS 0.7%CVE-2024-13838MEDIUMUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via WebhookEPSS 0.3%