The vulnerability arises from a missing capability check on several AJAX functions in the Uncanny Automator WordPress plugin. As a result, any authenticated user with subscriber-level permissions or higher can alter the plugin’s settings. This privilege escalation does not grant code execution but allows attackers to change configuration values, potentially redirecting automation flows, enabling unintended integrations, or creating conditions that could be leveraged in subsequent attacks. The weakness is classified as CWE-862, Missing Authorization.

Vendors affected are Uncanny Owl, product Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. All releases up to and including version 6.4.0.2 are vulnerable. Environments running any of these versions are at risk until upgraded.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% shows a very low probability of current exploitation. The issue is not listed in CISA’s KEV catalog, meaning no known, publicly disclosed exploits in the wild. The attack vector requires a legitimate authenticated session, presumably through normal WordPress login with subscriber or higher role.