CVE-2025-4520

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
Configurations

Configuration 1 (hide)

cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:*

History

12 Aug 2025, 01:55

Type Values Removed Values Added
CPE cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:*
References () https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99 - () https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve - Third Party Advisory
First Time Uncannyowl uncanny Automator
Uncannyowl

16 May 2025, 14:43

Type Values Removed Values Added
Summary
  • (es) El complemento Uncanny Automator para WordPress es vulnerable a la modificación no autorizada de datos debido a la falta de comprobación de capacidad en varias funciones AJAX en versiones hasta la 6.4.0.2 (incluida). Esto permite que atacantes autenticados, con permisos de suscriptor o superiores, actualicen la configuración del complemento.

14 May 2025, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-05-14 03:15

Updated : 2025-08-12 01:55


NVD link : CVE-2025-4520

Mitre link : CVE-2025-4520

CVE.ORG link : CVE-2025-4520


JSON object : View

Products Affected

uncannyowl

  • uncanny_automator
CWE
CWE-862

Missing Authorization