The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
References
Configurations
History
12 Aug 2025, 01:55
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:* | |
References | () https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99 - Product | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve - Third Party Advisory | |
First Time |
Uncannyowl uncanny Automator
Uncannyowl |
16 May 2025, 14:43
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
14 May 2025, 03:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2025-05-14 03:15
Updated : 2025-08-12 01:55
NVD link : CVE-2025-4520
Mitre link : CVE-2025-4520
CVE.ORG link : CVE-2025-4520
JSON object : View
Products Affected
uncannyowl
- uncanny_automator
CWE
CWE-862
Missing Authorization