50,000 WordPress Sites Affected by PHP Object Injection Vulnerability in Uncanny Automator WordPress Plugin

In case you missed it, Wordfence just published its annual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond.  

On April 26th, 2024, we received a submission for an authenticated PHP Object Injection vulnerability in Uncanny Automator, a WordPress plugin with more than 50,000 active installations. This vulnerability can be leveraged via an existing POP chain present in the plugin to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution by authenticated subscriber-level attackers possible.

Props to mikemyers who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,021.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on April 22, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on May 22, 2025.

We contacted the Uncanny Owl team on April 15, 2025 and received a response on the same day. After providing full disclosure details, the developer released the patch on April 18, 2025. We would like to commend the Uncanny Owl team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Uncanny Automator, version 6.4.0.2 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Uncanny Automator <= 6.4.0.1 – Authenticated (Subscriber+) PHP Object Injection in automator_api_decode_message Function

8.1

CVSS Rating
High (8.1)

CVE-ID
CVE-2025-3623

Affected Versions
<= 6.4.0.1

Patched Version
6.4.0.2

Bounty
$1,021.00

Affected Software

Uncanny Automator

Affected Software Slug

uncanny-automator

Researcher

mikemyers

The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.

More Details >

Technical Analysis

Uncanny Automator is a WordPress plugin that helps connect your WordPress website with other plugins and apps.

Examining the code reveals that the plugin uses the automator_api_decode_message() function in the Automator_Helpers_Recipe class to decode the encrypted api message.

public static function automator_api_decode_message( $message, $secret ) {
	$tokens = false;
	if ( ! empty( $message ) && ! empty( $secret ) ) {
		$message           = base64_decode( $message ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
		$method            = 'AES128';
		$iv                = substr( $message, 0, 16 );
		$encrypted_message = substr( $message, 16 );
		$tokens            = openssl_decrypt( $encrypted_message, $method, $secret, 0, $iv );
		$tokens            = maybe_unserialize( $tokens );
	}

	return $tokens;
}

The function first decodes it from Base64, then decrypts it with the secret specified in the function parameter, and finally unserializes it.

public function authenticate() {

	$data  = automator_filter_input( 'automator_api_message' );
	$nonce = automator_filter_input( 'nonce' );

	$credentials = Automator_Helpers_Recipe::automator_api_decode_message( $data, $nonce );

Unfortunately, this decode function is used in several AJAX functions where the secret code comes directly from user input. This means that an attacker can control the secret code, allowing them to provide any malicious encrypted serialized object, which will then be decrypted. The decrypted value is subsequently unserialized, which can make it possible for the attacker to perform a PHP Object Injection.

The plugin contains a POP chain that deletes a specified temp file during cleanup. This makes it possible for authenticated attackers with minimal access, like subscribers, to delete any arbitrary file on the server, including the site’s wp-config.php file. Deleting the wp-config.php forces the site into a setup state, allowing an attacker to take control by redirecting it to a database under their control. This ultimately provides access to the site’s server where further infection can take place.

Disclosure Timeline

April 4, 2025 – We received the submission for the PHP Object Injection vulnerability in Uncanny Automator via the Wordfence Bug Bounty Program.
April 14, 2025 – We validated the report and confirmed the proof-of-concept exploit.
April 15, 2025 – We initiated contact via the vendor contact form, asking that they confirm the inbox for handling the discussion.
April 15, 2025 – The vendor confirmed the inbox for handling the discussion.
April 15, 2025 – We sent over the full disclosure details to the vendor. The vendor acknowledged the report and began working on a fix.
April 18, 2025 – The fully patched version of the plugin, 6.4.0.2, was released.
April 22, 2025 – Wordfence Premium, Care, and Response users received a firewall rule to provide protection against any exploits that may target this vulnerability.
May 22, 2025 – Wordfence Free users will receive the same protection.

Conclusion

In this blog post, we detailed an PHP Object Injection to Arbitrary File Deletion vulnerability within the Uncanny Automator plugin affecting versions 6.4.0.1 and earlier. This vulnerability allows authenticated threat actors with subscriber-level permissions or higher to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. The vulnerability has been addressed in version 6.4.0.2 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of Uncanny Automator as soon as possible considering the critical nature of this vulnerability.

Wordfence users running Wordfence Premium, Wordfence Care, and Wordfence Response have been protected against these vulnerabilities as of April 22, 2025. Users using the free version of Wordfence will receive the same protection 30 days later on May 22, 2025.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post 50,000 WordPress Sites Affected by PHP Object Injection Vulnerability in Uncanny Automator WordPress Plugin appeared first on Wordfence.