The Uncanny Automator plugin for WordPress contains a vulnerability tied to missing capability checks in the add_role() and user_role() functions. Because the validate_rest_call() routine does not verify the caller’s authority, an authenticated user can change any other user’s role to administrator. This allows an attacker who already holds an account — for example a subscriber or contributor — to elevate privileges to full site ownership, compromising confidentiality, integrity and availability of the WordPress installation. The weakness is a classic authorization failure (CWE-862).

Versions of the Uncanny Automator plugin up to and including 6.3.0.2 are affected. The vulnerability impact spans all installations of Uncanny Owl’s Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress that have not yet been updated beyond that version.

The CVSS score of 8.8 classifies this flaw as high severity, and the EPSS of 26% indicates it is considered likely to be exploited. While lacking a KEV listing, the vulnerability is reachable through normal authentication mechanisms; an attacker must possess a valid account but can then change roles of any user. Successful exploitation grants full administrator control of the site, enabling data exfiltration, site defacement, and further attacks against connected services.