The Uncanny Automator plugin for WordPress suffers from a missing authorization flaw caused by incorrectly configured access control levels. The vulnerability allows an attacker to bypass intended role checks and perform actions normally reserved for higher-privileged users. It is inferred from the description that these actions may include creating, editing, or deleting automation tasks or accessing restricted plugin settings, potentially enabling unauthorized data modification or service disruption.

The vulnerability affects all installations of the WordPress Uncanny Automator plugin version 7.7.1 and earlier. Any WordPress site that has not upgraded past 7.7.1 is susceptible, regardless of the hosting environment or other plugins in use.

The CVSS base score is 5.3, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. It is inferred that the attack vector is through the WordPress web interface, as the flaw resides in the plugin's access control. The attacker would likely need an authenticated session, possibly with a user role that can interact with the plugin, to trigger the incorrectly configured permission checks.