CVE-2026-82627: CWE-502 Deserialization of Untrusted Data in uncannyowl Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included

CVE-2026-82627 describes a PHP Object Injection vulnerability in the Uncanny Automator – AI + Automation for WordPress plugin, affecting all versions up to 7.6.1.1. The vulnerability arises from unsafe deserialization of attacker-controlled data stored as trigger meta in recipes configured with third-party integration plugins such as PeepSo, MailPoet, or WPForms. Authenticated users with Subscriber-level privileges or higher can exploit this to inject PHP objects. The presence of a POP (Property Oriented Programming) chain within the plugin enables attackers to delete arbitrary files on the server, leading to high impact on confidentiality, integrity, and availability.

An attacker with at least Subscriber-level access can exploit this vulnerability to execute PHP Object Injection, resulting in arbitrary file deletion on the server. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability requires the presence of specific third-party integration plugins and configured recipes, limiting the attack surface but still posing a significant risk.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access and higher to trusted users only and review installed third-party integration plugins and configured recipes to minimize exposure.