The Uncanny Automator plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in multiple AJAX functions. This flaw allows authenticated users with low-level permissions (subscriber or above) to update plugin settings without proper capability checks. The vulnerability affects versions up to and including 6.4.0.2. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker with subscriber-level access can modify plugin settings unauthorizedly, potentially disrupting automation workflows or causing denial of service conditions related to the plugin. There is no direct confidentiality impact. The integrity and availability of the plugin's functionality can be affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious changes to plugin settings. Avoid granting unnecessary permissions to low-privilege users.