A missing authorization check in Uncanny Owl’s Uncanny Automator plugin allows an attacker to access or manipulate features the plugin exposes to authenticated users without proper privilege validation. This flaw can lead to the unauthorized execution of plugin functionality, potentially influencing site behavior or data. The weakness is classified as CWE‑862, indicating a failure to enforce adequate access controls.

The vulnerability is present in all installations of Uncanny Automator up to and including version 6.7.0.1 on WordPress sites. Any site that has the plugin at a version number equal to or lower than 6.7.0.1 is affected. No specific operating system or additional software dictates further constraints.

The CVSS score of 4.3 labels the flaw as moderate in severity. The EPSS score of < 1% indicates a very low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based: an attacker can send crafted requests to the plugin’s administrative endpoints or REST API without proper privilege checks. This inference is drawn from the description of the missing, as the official text does not specify the exact entry point.