WordPress Plugin Vulnerabilities

Uncanny Automator < 6.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

Description

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.

Affects Plugins

Plugin icon
uncanny-automator
Fixed in 6.5.0

References

CVE
CVE-2025-4520
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
mikemyers
Verified
No
WPVDB ID
95a60f45-15b4-4c7a-95d2-3de98454a67f

Timeline

Publicly Published
2025-05-09 (about 1 year ago)
Added
2025-05-13 (about 1 year ago)
Last Updated
2025-05-14 (about 1 year ago)

Other

Published
Title
Published
2025-11-20
Title
Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Published
2026-04-20
Title
Jupiter X Core < 4.14.2 - Missing Authorization
Published
2025-12-16
Title
Essential Blocks < 5.7.3 - Missing Authorization To Authenticated (Author+) Information Disclosure
Published
2024-03-21
Title
AI Post Generator < 3.4 - Subscriber+ Posts Read/Creation/Deletion
Published
2026-04-21
Title
Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php