The Uncanny Automator plugin for WordPress contains a vulnerability tied to missing capability checks in the add_role() and user_role() functions. Because the validate_rest_call() routine does not verify the caller’s authority, an authenticated user can change any other user’s role to administrator. The description indicates that privilege escalation requires an existing account, and it is inferred that the attacker may begin with a low‑privilege role such as Subscriber or Contributor. As a result, the attacker can elevate privileges to full site ownership, compromising confidentiality, integrity and availability of the WordPress installation. The weakness is a classic authorization failure (CWE-862).

Versions of the Uncanny Automator plugin up to and including 6.3.0.2 are affected. The vulnerability impact spans all installations of Uncanny Owl’s Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress that have not yet been updated beyond that version.

The CVSS score of 8.8 classifies this flaw as high severity, and the EPSS of 10% indicates it is considered likely to be exploited. While lacking a KEV listing, the vulnerability is reachable through normal authentication mechanisms; an attacker must possess a valid account but can then change roles of any user. Successful exploitation grants full administrator control of the site, enabling data exfiltration, site defacement, and further attacks against connected services.