The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This flaw allows an unauthenticated attacker to construct a malicious object that, when processed by the plugin, can delete arbitrary files on the server. The ability to remove files can lead to compromising configuration, injecting additional code, or facilitating further attacks.

WordPress sites running the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin by uncannyowl with versions <=6.4.0.1. The vulnerability applies to any installation that has this plugin exposed to outside traffic and does not restrict access to the automator_api_decode_message endpoint.

The CVSS score of 9.1 indicates high severity, while an EPSS score of 1% suggests a realistic but moderate chance of exploitation. The flaw is not listed in CISA's KEV catalog. The likely attack vector is unauthenticated HTTP requests targeting the automator API endpoint, which must be reachable without login credentials. Once the payload is sent, an attacker can induce file deletion, potentially escalating privileges or allowing further exploitation depending on server configuration.