PHP Object Injection in Uncanny Automator WordPress Plugin

Executive Summary

This vulnerability is a PHP Object Injection flaw in the Uncanny Automator WordPress plugin. It allows authenticated attackers with Subscriber-level access or higher to inject malicious PHP objects via deserialization of untrusted input. The attack requires a third-party integration plugin (like PeepSo, MailPoet, or WPForms) and a configured recipe storing attacker-controlled data as trigger meta.

Useful 0 Not Useful 0

Detection Guidance

Check for installed versions of the Uncanny Automator plugin up to 7.6.1.1. Review WordPress user roles for Subscriber-level access or higher. Inspect third-party integrations like PeepSo, MailPoet, or WPForms for configured recipes storing untrusted data.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete arbitrary files on the server due to a POP chain within Uncanny Automator. This could lead to data loss, website downtime, or further compromise of the WordPress environment if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to delete arbitrary files on the server, which could lead to unauthorized data deletion or corruption. For GDPR, this could impact data integrity and availability, potentially violating Article 5 requirements for secure processing. For HIPAA, unauthorized file deletion could disrupt healthcare operations and compromise protected health information integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Uncanny Automator plugin to the latest version beyond 7.6.1.1. Remove or restrict Subscriber-level user access. Disable unused third-party integrations. Monitor for unauthorized file deletions or suspicious activity.

Useful 0 Not Useful 0