CVE-2025-2075: Uncanny Automator Privilege Escalation Flaw

CVE-2025-2075 Overview

CVE-2025-2075 is a privilege escalation vulnerability in the Uncanny Automator WordPress plugin affecting all versions up to and including 6.3.0.2. The flaw resides in the add_role() and user_role() functions, which lack proper capability checks within the validate_rest_call() function. An authenticated attacker with a low-privilege account can assign the administrator role to any user, including themselves, gaining full control of the WordPress site. The vendor, Uncanny Owl, has released patches via WordPress.org plugin updates. The vulnerability maps to CWE-862: Missing Authorization and carries an EPSS probability of 10.36%, placing it in the 93rd percentile for likelihood of exploitation.

Critical Impact
An authenticated attacker with any valid WordPress account can elevate themselves or arbitrary users to administrator, achieving full site takeover including content modification, plugin installation, and access to stored credentials.

Affected Products

Uncanny Automator plugin for WordPress, all versions through 6.3.0.2
WordPress sites with the Easy Automation, Integration, Webhooks & Workflow Builder plugin installed
Both free and Pro editions distributed by Uncanny Owl

Discovery Timeline

2025-04-04 - CVE-2025-2075 published to NVD
2025-08-08 - Last updated in NVD database

Technical Details for CVE-2025-2075

Vulnerability Analysis

The vulnerability exists in the Uncanny Automator plugin's REST API request handling within class-background-actions.php. The plugin exposes background action endpoints that delegate authorization to the validate_rest_call() function. This function fails to enforce capability checks before allowing role assignment operations. As a result, the add_role() and user_role() functions can be invoked by any authenticated user, regardless of privilege level. An attacker holding a subscriber-level account, which WordPress sites with open registration commonly grant, can craft a request that promotes any user ID to the administrator role. Administrator access on a WordPress site enables theme and plugin installation, leading directly to arbitrary PHP code execution on the underlying server.

Root Cause

The root cause is a missing authorization check, classified under [CWE-862]. The validate_rest_call() function authenticates the request but does not verify that the caller possesses the manage_options or equivalent capability required to modify user roles. Role-changing operations were treated as standard plugin actions rather than privileged administrative functions.

Attack Vector

Exploitation requires network access to the WordPress REST API and an active account on the target site, even at the lowest privilege tier. The attacker sends a crafted REST request to the vulnerable background action endpoint exposed by Uncanny Automator. The request specifies a target user ID and the desired role string. Because validate_rest_call() permits the operation without a capability check, the server updates the user's role in the database. The attacker then logs in with the elevated account and exercises full administrative control.

No verified public proof-of-concept code is available. The patch diffs are visible in the Uncanny Automator plugin changesets 3257300 and 3265280, which add the missing capability enforcement.

Detection Methods for CVE-2025-2075

Indicators of Compromise

Unexpected users appearing in the WordPress wp_users table with administrator role assignments in wp_usermeta
REST API requests targeting Uncanny Automator background action endpoints from low-privilege session cookies
New plugin or theme installations performed by recently elevated accounts
Outbound connections from the web server to attacker-controlled infrastructure following a role change event

Detection Strategies

Audit the WordPress user role table for accounts elevated to administrator outside scheduled administrative activity
Review web server access logs for POST requests to /wp-json/uncanny-automator/ endpoints from unauthenticated or subscriber-tier sessions
Correlate role-change events in WordPress audit logs against the originating IP and authenticated user identity
Inspect class-background-actions.php request payloads for parameters referencing add_role or user_role actions

Monitoring Recommendations

Enable WordPress activity logging plugins to record all role and capability modifications in real time
Forward webserver and PHP error logs to a central log analytics platform for retention and search
Alert on creation of new administrator accounts or promotion of existing accounts within short time windows
Monitor for installation of new plugins or themes immediately following authentication of a non-administrator user

How to Mitigate CVE-2025-2075

Immediate Actions Required

Update Uncanny Automator to a version newer than 6.3.0.2 that includes the fixes from changesets 3257300 and 3265280
Audit all administrator accounts and remove any that cannot be attributed to legitimate users
Force password resets for all administrator and editor-level accounts on affected sites
Disable open user registration on WordPress sites that do not require it, reducing the pool of accounts an attacker can leverage

Patch Information

Uncanny Owl has released fixed versions through the WordPress.org plugin repository. The corrective commits add capability validation to the REST request handler in src/core/classes/class-background-actions.php. Refer to the Wordfence Vulnerability Report for the confirmed patched version range and the WordPress Plugin Change Log for the source-level diff.

Workarounds

Deactivate and remove the Uncanny Automator plugin until patching is possible
Place the WordPress REST API behind an authenticated reverse proxy or web application firewall rule that blocks Uncanny Automator endpoints for non-administrator sessions
Restrict default new-user roles to subscriber and review any custom role-management workflows for accounts created during the exposure window

bash

# Update Uncanny Automator via WP-CLI to the latest patched release
wp plugin update uncanny-automator

# Verify installed version is greater than 6.3.0.2
wp plugin get uncanny-automator --field=version

# List all administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered