The vulnerability is a PHP Object Injection flaw present in versions of the Uncanny plugin up to 7.3.0.6. The flaw allows an attacker to supply crafted serialized objects that the application des validation, which can lead to arbitrary code execution on the host. This represents a classic example of CWE‑502, a data serialization vulnerability, and can compromise the confidentiality, integrity, and availability of the site and its underlying infrastructure.

Affected systems are WordPress installations that have the Uncanny Owl Uncanny Automator Pro plugin installed with a version less than or equal to 7.3.0.6. The plugin is distributed by Uncanny Owl and is commonly used to automate actions within WordPress. No other products or vendors are listed in the CNA data.

The CVSS score of 9.8 categorizes this flaw as critical, indicating a high likelihood of serious exploitation. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the absence of a KEV listing does not diminish the severity. Based on the nature of PHP Object Injection, the most likely attack vector involves an attacker sending malicious payloads to the plugin via endpoints that accept serialized data; it may be possible through exposed APIs, form submissions, or direct requests. Specific prerequisites such as authentication are not detailed in the CVE description, so the exact attack path remains inferred.