CVE-2026-12375: Uncanny Owl Uncanny Automator Pro supply chain compromise and backdoor

CVE-2026-12375 · Severity: info · CVSS 10 · Published 2026-07-07

The Uncanny Automator Pro plugin for WordPress was distributed with malicious code after the vendor's update servers were compromised. This backdoor allows unauthorized individuals to gain full administrative control over a website and steals sensitive security keys. Because the malicious code was delivered through an official update channel, affected sites may have been compromised automatically.

Vendors: Uncanny Owl.

Quick answers

Is CVE-2026-12375 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12375 being exploited in the wild.
How severe is CVE-2026-12375?
Informational severity, with a CVSS score of 10, published 7 July 2026.
Which products and versions are affected?
Uncanny Owl Uncanny Automator Pro 7.3.0.5.
Is there a fix for CVE-2026-12375?
A patch was published on 2026-06-13: Vendor removed attacker access and published clean version 7.3.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12375 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12375?
Check whether you run Uncanny Owl Uncanny Automator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A supply chain compromise of the Uncanny Owl update server led to the distribution of a trojanized version of Uncanny Automator Pro (v7.3.0.5). The malicious code injects an 'init' hook into the plugin's main file that beacons the site's AUTH_KEY and SECURE_AUTH_KEY to an attacker-controlled C2 server. Using these keys, an attacker can generate a valid HMAC token to bypass authentication via a specific query parameter ('_wplogin'), granting them an active session as the site's primary administrator. The vendor has released version 7.3.0.6 to remediate the distribution channel, but manual cleanup of infected databases (specifically the '_wpc_uid' option and '_wpcs' transient) is required.

Affected products

  • Uncanny Owl Uncanny Automator Pro 7.3.0.5

Timeline

  • 2026-06-13: patched: Vendor removed attacker access and published clean version 7.3.0.6
  • 2026-06-16: disclosed: Public disclosure by WPScan
  • 2026-07-07: advisory: NVD publication of CVE-2026-12375

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.