Uncanny Automator Pro Supply Chain Backdoor: Unauthenticated Admin Takeover

Vulnerability Overview Uncanny Automator Pro 7.3.0.5 - Supply Chain Compromise via Compromised Vendor Update Server This vulnerability arises from the compromise of the plugin's update/distribution infrastructure, resulting in the distribution of a plugin containing malicious code. The injected backdoor allows unauthenticated attackers to gain administrative session access on affected websites and exfiltrate the site's authentication keys and administrator details to a server controlled by the attacker. Scope of Impact Affected Versions: 7.3.0.5 (unofficial release, not listed in the vendor's changelog which skips from 7.3.0.4 to 7.3.0.6). The verified clean version is 7.3.0.6. Indicators of Compromise (IOCs): WordPress option and transient ; unauthenticated requests containing the query parameter; outbound beacons to and ; and injected init hook code within (see PoC). Remediation Fixed Version: 7.3.0.6 Recommendations: Based on vendor advice, simply removing and reinstalling the plugin may not fully clean an infected site. Vendor advisory: https://automatorplugin.com/security-incident-notice-uncanny-automator/ Proof of Concept (PoC) Code Additional Information CVE ID: CVE-2026-12375 References: https://automatorplugin.com/security-incident-notice-uncanny-automator/ Original Researcher: Mike Gozdikowski Submitter: Mike Gozdikowski Validation Status: Verified WPVDB ID: ddc83705-3df6-427c-957b-935135330f73 Timeline Public Release Date: 2026-06-16 (approx. 21 days ago) Date Added: 2026-06-16 (approx. 20 days ago) Last Updated: 2026-07-03 (approx. 3 days ago) Other Related Vulnerabilities 2020-01-27: binmrpb - Webshell in Fake Plugin 2017-12-19: Captcha 4.3.6-4.4.4 - Backdoored 2025-07-11: GravityForms 2.9.11.1/2.9.12 - Malware Compromise 2019-03-29: Pipdig Power Pack < 4.8.0 - Vendor Backdoors & Suspicious Code 2026-06-19: EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor

Goal Reached Thanks to every supporter — we hit 100%!

Uncanny Automator Pro Supply Chain Backdoor: Unauthenticated Admin Takeover