CVE-2025-4520: Uncannyowl Uncanny Automator

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.

Affected products

• Uncannyowl Uncanny Automator: before 6.5.0 (fixed in 6.5.0)

Published 2025-05-14. Last modified 2026-06-17.