The Uncanny Automator plugin is vulnerable to a server‑side request forgery that lets authenticated administrators use the download_url() function to fetch arbitrary URLs. Because the content of those URLs is stored on the web server, an attacker can upload a malicious file that could be executed as code, giving full control over the site. This flaw is identified as CWE‑434 (Unrestricted Upload of File with Dangerous Type).

WordPress sites running the Uncanny Automator plugin up to and including version 7.0.0.3 are affected. The vulnerability is present in all releases prior to 7.0.0.4. Administrator‑level users (or higher) on such sites can exploit it.

The CVSS score of 7.2 classifies this as high impact. The EPSS score is less than 1 %, indicating low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the flaw requires only authenticated administrator access—commonly available in many WordPress installations—the threat remains real. The attack path involves an administrator logging into the WordPress admin area, invoking the download_url() feature, and supplying a crafted URL that points to a malicious file. The server then retrieves and stores this file on the file system, where it can be executed if the attacker can trigger it, such as by accessing the file via a public URL or by uploading through the plugin’s UI.