Uncanny Automator Pro 7.3.0.5 – Backdoor via Compromised Vendor Update Server | CVE 2026-12375

Description

The plugin was distributed with malicious code after the vendor's plugin update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.

Affected build: 7.3.0.5 (not an official release - absent from the vendor changelog, which goes 7.3.0.4 -> 7.3.0.6). Verified-clean build: 7.3.0.6.

Indicators of compromise: the WordPress option "_wpc_uid" and transient "_wpcs"; unauthenticated requests carrying a "_wplogin" query parameter; outbound beacons to https://tidio.cc/ua/recv.php and http://84.201.6.54/ua/recv.php; and the injected init-hook code in uncanny-automator-pro.php (see PoC).

Per the vendor, removing and reinstalling the plugin alone may not fully clean an infected site. Vendor advisory: https://automatorplugin.com/security-incident-notice-uncanny-automator/

Proof of Concept

The malicious 7.3.0.5 build has been withdrawn (the vendor published a verified-clean 7.3.0.6 and removed attacker access on 2026-06-13), so the update-server delivery in step 3 is no longer live-reproducible. The steps below identify an infected install and demonstrate the backdoor's impact.

=== 1. Identify an infected install ===
- The trojanized build reports version 7.3.0.5 - a version that does not exist in the official Uncanny Automator Pro changelog.
- Grep wp-content/plugins/uncanny-automator-pro/uncanny-automator-pro.php for the injected init hooks (signature below).
- Check the database for option "_wpc_uid" and transient "_wpcs".

Injected backdoor code (appended after `Automator_Pro_Load::get_instance();` in uncanny-automator-pro.php)

=== 2. Demonstrate impact: unauthenticated administrator takeover ===
The first hook registers an unauthenticated "magic login"; the second hook beacons the site's AUTH_KEY/SECURE_AUTH_KEY to the C2, from which the operator computes:

    token = hash_hmac('sha256', 'magic_login', AUTH_KEY . SECURE_AUTH_KEY)

An unauthenticated request then logs the attacker in as the first administrator (the user id stored in option _wpc_uid):

    curl -i 'https://TARGET-SITE/?_wplogin=<token>&r=<base64 of an admin URL>'

The response issues an authentication cookie for that administrator and 302-redirects, yielding an unauthenticated admin session.

=== 3. Discovery: how the malicious build was served (affected site + license key REDACTED; no longer reproducible after vendor remediation) ===
A get_version update check to the then-compromised licensing server returned a package_download URL for the malicious 7.3.0.5 build:

    curl -s -X POST 'https://licensing.uncannyowl.com/' \
      -A 'WordPress/6.5; https://AFFECTED-SITE' \
      -H 'X-UO-Destination: ap' \
      -H 'X-UO-Licensing: <base64 license payload REDACTED>' \
      -d 'edd_action=get_version' \
      -d 'item_id=506' \
      --data-urlencode 'item_name=Uncanny Automator Pro' \
      --data-urlencode 'license=<LICENSE KEY REDACTED>' \
      --data-urlencode 'url=https://AFFECTED-SITE' \
      -d 'slug=uncanny-automator-pro' \
      -d 'version=7.3.0.4'