CVE-2025-66056 MEDIUM

CVE-2025-66056: WordPress Uncanny Automator plugin < 6.10.0 - Sensitive Data Exposure vulnerability

Vendor Uncanny Owl
Product Uncanny Automator
Weakness CWE-497
Published November 21, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0.

Explanation of Vulnerability in Simple Terms

02Summary

Uncanny Automator versions up to 6.10.0 expose sensitive information to authenticated users with low privileges. An attacker with a basic user account can read data they should not have access to. The vulnerability requires an active login but no additional user interaction. Update to a version newer than 6.10.0 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive information accessible only to higher-privilege users.

Potential impact on your site

04Site Impact

User data and site configuration details may be exposed to any authenticated user.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

November 21, 2025 CVE published
April 28, 2026 Record updated