The Uncanny Automator plugin for WordPress suffers a missing authorization flaw, allowing a user with any authenticated role to perform actions that should be restricted. An attacker who can gain user access—such as a low‑privileged attacker—might exploit the incorrect configuration of access control security levels, potentially altering plugin settings or accessing protected data. This flaw is identified as CWE‑862, a missing authorization weakness.

The issue impacts the Uncanny Owl Uncanny Automator WordPress plugin, specifically versions up through 6.4.0.2. Users running any of those versions are vulnerable until the plugin is updated beyond that release.

This vulnerability carries a CVSS score of 6.5, indicating moderate severity. The current EPSS score is below 1%, suggesting the likelihood of exploitation is low, and it is not listed in the CISA KEV catalog. Exploitation would require the attacker to authenticate to the WordPress site and then target the plugin’s functionality; it does not rely on remote code execution but leverages flawed access controls. Because the weakness permits unauthorized privilege escalation within the plugin, careful validation of user roles and permissions is essential in assessing risk.