CVE-2026-82627 Overview
The Uncanny Automator plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 7.6.1.1. The flaw stems from deserialization of untrusted input [CWE-502] processed as trigger meta data. Authenticated attackers holding Subscriber-level access or higher can inject arbitrary PHP objects when a supported third-party integration plugin such as PeepSo, MailPoet, or WPForms is installed and a recipe stores attacker-controlled data. A Property-Oriented Programming (POP) chain present in Uncanny Automator extends the impact, allowing attackers to delete arbitrary files on the server.
Critical Impact
Authenticated attackers with low-privileged accounts can delete arbitrary server files through a built-in POP chain, enabling site destabilization or takeover.
Affected Products
- Uncanny Automator – AI + Automation for WordPress plugin, all versions through 7.6.1.1
- WordPress installations running Uncanny Automator alongside third-party integrations (PeepSo, MailPoet, WPForms, and similar)
- Sites where authenticated Subscriber or higher accounts can configure or interact with recipes
Discovery Timeline
- 2026-10-08 - CVE-2026-82627 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-82627
Vulnerability Analysis
The vulnerability resides in how Uncanny Automator processes trigger meta data supplied through third-party integration plugins. When the plugin stores and later retrieves this meta data, it passes attacker-controlled input to a PHP deserialization routine without validating the structure or source. An authenticated user with Subscriber-level access can configure recipe triggers that embed serialized PHP objects into persistent storage.
On subsequent processing, the serialized payload is unserialized, instantiating attacker-chosen classes and invoking their magic methods. Uncanny Automator ships code paths that form a usable POP chain, meaning the attacker does not need to rely on classes from WordPress core or other plugins. The chain terminates in file deletion primitives, letting the attacker remove arbitrary files on the underlying host.
Deleting files such as wp-config.php triggers the WordPress installation flow on the next request, which an attacker can abuse to point the site at an attacker-controlled database and achieve full compromise.
Root Cause
The root cause is unsafe deserialization of untrusted input [CWE-502]. The plugin invokes unserialize() on data that originates from authenticated users via integrated form or workflow plugins, without using safe alternatives such as JSON decoding or an allow-list of acceptable classes.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with at least Subscriber privileges. The attacker also needs a supported third-party integration plugin installed and a recipe configured such that attacker-supplied input is stored as trigger meta. The elevated attack complexity reflects these preconditions. Successful exploitation yields arbitrary file deletion on the server.
No verified public exploit code is available at this time. Technical specifics are documented in the Wordfence Vulnerability Report and the WordPress Changeset Update.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-82627
Indicators of Compromise
- Unexpected deletion or truncation of files inside the WordPress document root, especially wp-config.php, .htaccess, or files under wp-content/
- Recipe trigger meta entries containing serialized PHP payloads with prefixes such as O:, a:, or references to Uncanny Automator classes
- WordPress installation screen appearing on a previously functional site, indicating wp-config.php removal
- Audit log entries showing recipe creation or modification by low-privileged Subscriber accounts
Detection Strategies
- Inspect the database tables used by Uncanny Automator for serialized strings in trigger meta fields and flag values that deserialize into object graphs
- Monitor PHP error logs for __destruct, __wakeup, or unserialize() warnings referencing Uncanny Automator namespaces
- Alert on file deletion events within the web root performed by the PHP-FPM or web server user outside of normal plugin update windows
Monitoring Recommendations
- Enable WordPress audit logging covering user registration, role changes, and recipe configuration activity
- Baseline file integrity for the WordPress installation and alert on deletions of core and configuration files
- Review installed integration plugins (PeepSo, MailPoet, WPForms, and similar) and restrict new user registration if not required
How to Mitigate CVE-2026-82627
Immediate Actions Required
- Update the Uncanny Automator plugin to a version later than 7.6.1.1 that incorporates the fix delivered in WordPress Changeset 3721435
- Disable open user registration or restrict it to trusted sources until the patch is applied
- Audit existing Subscriber-level accounts and remove unused or suspicious users
- Review recipes and remove any that contain unexpected serialized data in trigger meta
Patch Information
The maintainers addressed the vulnerability in the plugin update tracked by WordPress Changeset 3721435. Site administrators should install the patched release through the WordPress plugin manager or WP-CLI. Full vulnerability details are published in the Wordfence Vulnerability Report.
Workarounds
- Deactivate the Uncanny Automator plugin until the patched version can be deployed
- Deactivate affected third-party integration plugins (PeepSo, MailPoet, WPForms) that expose attacker-controllable fields into recipe triggers
- Enforce stricter role assignment so that no untrusted users can obtain Subscriber or higher access
- Place the WordPress site behind a web application firewall configured to block requests containing serialized PHP object payloads
# Update the plugin via WP-CLI once a patched release is available
wp plugin update uncanny-automator
# Alternatively, deactivate the plugin until patching is possible
wp plugin deactivate uncanny-automator
# Disable open user registration as a defense-in-depth measure
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
