CVE-2026-12375 is a critical vulnerability in the uncanny-automator-pro WordPress plugin prior to version 7.3.0.6. The vendor's update and distribution infrastructure was compromised, resulting in the distribution of plugin versions containing a hidden backdoor. This backdoor enables unauthenticated attackers to obtain administrator sessions on affected sites and leak sensitive information such as secret keys and administrator details to external attacker-controlled servers. The vulnerability is categorized under CWE-912 (Hidden Functionality). No official patch or remediation guidance has been provided yet.

Successful exploitation allows unauthenticated attackers to gain full administrative access to affected WordPress sites, compromising site confidentiality, integrity, and availability. Additionally, secret keys and administrator details are exfiltrated, increasing the risk of further attacks or persistent compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected sites should consider removing or disabling the plugin version 7.3.0.5 and monitoring for suspicious activity. Avoid using the affected version and verify plugin integrity from trusted sources.