What the vulnerability does
01Description
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
02Summary
Uncanny Automator versions up to 7.0.0.3 allow authenticated administrators to upload files without proper validation. An attacker with admin access can upload malicious files to the site, potentially including executable code. This vulnerability requires high-level privileges and does not affect the confidentiality or integrity of other users' data directly, but compromises site integrity.
What an attacker can do
03Attacker Capabilities
Upload malicious files to the site, including executable code, if they have admin access.
Potential impact on your site
04Site Impact
A compromised admin account can upload files that execute code on your server, leading to full site takeover.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the WordPress site.
Key dates
06Disclosure timeline
March 3, 2026
CVE published
April 8, 2026
Record updated
