CVE-2026-12375: WordPress Plugin Auth Bypass Vulnerability

CVE-2026-12375 Overview

CVE-2026-12375 is a supply chain compromise affecting the Uncanny Automator Pro WordPress plugin in versions prior to 7.3.0.6. Attackers breached the vendor's update and distribution infrastructure and injected malicious code into the plugin package. The backdoor grants unauthenticated attackers an administrator session on any site running the trojanized build. It also exfiltrates site secret keys and administrator account details to attacker-controlled servers.

Critical Impact
Any WordPress site running Uncanny Automator Pro below 7.3.0.6 is likely already compromised. Attackers can obtain administrator access without authentication and harvest credentials and secret keys.

Affected Products

Uncanny Automator Pro WordPress plugin versions prior to 7.3.0.6
WordPress sites that installed or auto-updated the trojanized plugin build
Sites where the plugin's secret keys or administrator credentials were exposed during the compromise window

Discovery Timeline

2026-07-07 - CVE-2026-12375 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-12375

Vulnerability Analysis

This is a software supply chain attack rather than a traditional code defect. The vendor's distribution infrastructure was compromised, and a malicious payload was inserted into the Uncanny Automator Pro plugin before it was signed and shipped to customers. Sites that downloaded or automatically updated to the affected build executed the attacker's code with full plugin privileges inside WordPress.

The injected logic acts as a persistent backdoor. It creates an unauthenticated path for attackers to assume an administrator session, bypassing the normal WordPress login flow entirely. It also beacons out to attacker-controlled infrastructure with the site's secret keys, including values used to sign authentication cookies, and details of existing administrator accounts.

Root Cause

The root cause is a compromise of the vendor's build or release pipeline that allowed unauthorized modification of a signed plugin artifact. This is a trust boundary failure in the supply chain, not a coding flaw in Uncanny Automator Pro itself. Any customer who trusted the vendor's official distribution channel received the backdoored code.

Attack Vector

Exploitation requires no authentication, no user interaction, and no local access. An attacker sends a network request to a vulnerable WordPress site and is handed an administrator session by the backdoor. From that position, attackers can install additional plugins, modify content, pivot to underlying hosting infrastructure, and use the exfiltrated secret keys to forge session tokens even after the plugin is removed.

The vulnerability is described in prose only; no verified proof-of-concept code is published. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12375

Indicators of Compromise

Presence of Uncanny Automator Pro plugin files with a version below 7.3.0.6 in wp-content/plugins/uncanny-automator-pro/
Outbound HTTP or HTTPS requests from the web server to unrecognized external hosts shortly after plugin installation or update
Unexpected administrator accounts in wp_users or unexplained changes to existing administrator email addresses
Modifications to wp-config.php or rotation events for AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values that were not initiated by an administrator

Detection Strategies

Inventory all WordPress installations and identify any running Uncanny Automator Pro at a version below 7.3.0.6
Compare installed plugin file hashes against the clean 7.3.0.6 release published by the vendor
Review web server access logs for unauthenticated requests that resulted in authenticated administrator activity
Correlate plugin update timestamps with new outbound connections from the web host

Monitoring Recommendations

Alert on creation of new WordPress administrator accounts and on privilege changes to existing accounts
Monitor egress traffic from web servers to non-corporate destinations, particularly immediately after plugin updates
Track integrity of wp-config.php and plugin directories with file integrity monitoring
Watch for anomalous session activity where administrator actions occur without a preceding successful login event

How to Mitigate CVE-2026-12375

Immediate Actions Required

Update Uncanny Automator Pro to version 7.3.0.6 or later on every affected site
Assume compromise on any site that ran an affected version and initiate incident response
Rotate all WordPress secret keys and salts in wp-config.php to invalidate any forged sessions
Reset passwords for all administrator accounts and audit the user table for unauthorized additions

Patch Information

The vendor has released Uncanny Automator Pro 7.3.0.6, which removes the injected backdoor. Site owners should install this version directly from the vendor and verify the plugin file hashes match the clean release. Refer to the WPScan Vulnerability Report for reference details.

Workarounds

Disable and remove the Uncanny Automator Pro plugin until the site can be fully audited and restored
Restore the site from a known-good backup taken before the trojanized plugin was installed
Restrict outbound network access from the web server to block beaconing to attacker infrastructure
Enforce multi-factor authentication on all WordPress administrator accounts after key rotation

bash

# Confirm installed Uncanny Automator Pro version and remove if vulnerable
wp plugin get uncanny-automator-pro --field=version
wp plugin deactivate uncanny-automator-pro
wp plugin delete uncanny-automator-pro

# Rotate WordPress secret keys after compromise
curl -s https://api.wordpress.org/secret-key/1.1/salt/
# Replace the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY,
# AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, and NONCE_SALT values
# in wp-config.php with the freshly generated output.