PHP Object Injection in Uncanny Automator WordPress Plugin

Uncanny Automator, a WordPress plugin designed for automation, contains a critical PHP Object Injection vulnerability tracked as CVE-2026-82627. The flaw affects all versions up to and including 7.6.1.1. It arises from the insecure deserialization of untrusted input processed during the execution of automation recipes.

An attacker requires authenticated access with at least Subscriber-level privileges to initiate the exploit. The attack is contingent upon the presence of specific third-party integration plugins, such as PeepSo, MailPoet, or WPForms, and requires the target to have an automation recipe configured that stores user-controlled data as trigger meta. Leveraging a property-oriented programming (POP) chain present within the plugin codebase, an attacker can bypass standard security controls to delete arbitrary files on the underlying web server, potentially leading to a complete service disruption or further compromise.

Impact

Successful exploitation allows authenticated users with low-level privileges (Subscriber) to delete critical system or application files on the WordPress server. This could lead to a site going offline, the removal of configuration files, or the destruction of essential plugin data. This vulnerability affects any WordPress environment using the Uncanny Automator plugin combined with supported third-party integrations.

Recommendation

1. Upgrade the Uncanny Automator plugin to the version released after 7.6.1.1 that contains the patch for CVE-2026-82627.
2. Audit user permissions for WordPress subscribers to ensure that only trusted users have access to features interacting with third-party integration automation recipes.
3. Implement file integrity monitoring (FIM) on the web server to detect unexpected file deletion activity originating from the web application process (e.g., www-data, apache).