The Uncanny Automator WordPress plugin contains an unauthenticated PHP Object Injection flaw that allows an attacker to delete any file on the server through the fr_token function, potentially targeting critical files such as wp-config.php. This file deletion can evolve into remote code execution if a vital configuration file is removed, exposing the site to full compromise. The weakness is identified as CWE‑502, reflecting unsafe PHP object serialization handling.

WordPress sites using the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin, any version up to and including 7.3.1.4. The flaw is exploitable when the plugin is paired with a Forminator form that triggers an Automator recipe set to accept submissions from 'Everyone', regardless of authentication.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% shows that active exploitation is presently uncommon but still possible. Because the vulnerability is not listed in the CISA KEV catalog, no widespread active exploitation is currently documented. The attack requires no additional gadget libraries; the plugin’s Action_Helpers_Email __destruct() method provides the necessary gadget chain, and the attacker must only submit a crafted serialized payload through an unauthenticated Forminator form.