CVE-2025-3623: CWE-502 Deserialization of Untrusted Data in uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
AI Analysis
Technical Summary
The Uncanny Automator plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) in the automator_api_decode_message() function, which deserializes untrusted input. This flaw allows unauthenticated attackers to inject malicious PHP objects. The presence of a POP (Property Oriented Programming) chain enables attackers to leverage this injection to delete arbitrary files on the server. The vulnerability affects all versions up to and including 6.4.0.1 and has a CVSS 3.1 base score of 9.1, reflecting critical impact with high integrity and availability impact.
Potential Impact
Successful exploitation can lead to arbitrary code execution without authentication, allowing attackers to delete arbitrary files on the affected system. This compromises the integrity and availability of the server hosting the plugin. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
No official patch or fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, it is recommended to disable or remove the Uncanny Automator plugin if possible, or restrict access to the vulnerable functionality to trusted users only. Monitor vendor channels for updates and apply official patches immediately once available.
CVE-2025-3623: CWE-502 Deserialization of Untrusted Data in uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
Description
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Uncanny Automator plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) in the automator_api_decode_message() function, which deserializes untrusted input. This flaw allows unauthenticated attackers to inject malicious PHP objects. The presence of a POP (Property Oriented Programming) chain enables attackers to leverage this injection to delete arbitrary files on the server. The vulnerability affects all versions up to and including 6.4.0.1 and has a CVSS 3.1 base score of 9.1, reflecting critical impact with high integrity and availability impact.
Potential Impact
Successful exploitation can lead to arbitrary code execution without authentication, allowing attackers to delete arbitrary files on the affected system. This compromises the integrity and availability of the server hosting the plugin. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
No official patch or fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, it is recommended to disable or remove the Uncanny Automator plugin if possible, or restrict access to the vulnerable functionality to trusted users only. Monitor vendor channels for updates and apply official patches immediately once available.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-04-15T01:34:31.565Z
- Cisa Enriched
- true
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 682cd0fc1484d88663aecb0f
Added to database: 5/20/2025, 6:59:08 PM
Last enriched: 4/9/2026, 9:29:32 PM
Last updated: 5/9/2026, 8:21:24 PM
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.