An unauthenticated PHP Object Injection flaw exists in the WordPress Uncanny Automator plugin up to and including version 7.3.1.2. The plugin processes serialized data from users and directly instantiates objects during normal operation, enabling an attacker to craft a payload that can execute arbitrary code or otherwise compromise the site. The weakness is identified as CWE‑502 and can lead to a full site compromise if exploited.

WordPress installations that host the Uncanny Owl Uncanny Automator plugin at version 7.3.1.2 or earlier. Because the plugin hooks into standard WordPress integration points and does not require special privileges to operate, any site running a vulnerable version is at risk.

The flaw carries a CVSS score of 8.1, indicating high severity, and is exploitable without authentication. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale exploitation has been recorded so far. Based on the description, it is inferred that the likely attack vector involves unauthenticated HTTP requests to publicly accessible endpoints that accept serialized input, such as the plugin’s REST API or other internal interfaces. Successful exploitation could enable remote code execution or privilege escalation on the affected server.