CVE-2026-12375 describes a supply chain compromise affecting the uncanny-automator-pro WordPress plugin before version 7.3.0.6. The vendor's update/distribution infrastructure was compromised, resulting in the distribution of plugin version 7.3.0.5 containing a hidden backdoor. This backdoor enables unauthenticated attackers to obtain administrator sessions on impacted WordPress sites and beacon sensitive information such as secret keys and administrator details to external attacker-controlled servers. The vulnerability is classified under CWE-912 (Hidden Functionality). No official patch or remediation level has been confirmed in the available data.

The impact includes unauthorized administrative access to affected WordPress sites and leakage of sensitive credentials and secret keys. This could lead to full site compromise, data theft, and further malicious activities under the attacker’s control. The compromise originates from the vendor's distribution channel, making all sites running the affected plugin version vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, affected sites should consider removing or disabling the affected plugin version 7.3.0.5. Monitoring for suspicious administrator sessions and unauthorized data transmissions is recommended. Follow vendor communications closely for updates on remediation.