Executive brief
The Uncanny Automator Pro plugin for WordPress was distributed with malicious code after the vendor's update servers were compromised. This backdoor allows unauthorized individuals to gain full administrative control over a website and steals sensitive security keys. Because the malicious code was delivered through an official update channel, affected sites may have been compromised automatically.
Technical details
A supply chain compromise of the Uncanny Owl update server led to the distribution of a trojanized version of Uncanny Automator Pro (v7.3.0.5). The malicious code injects an 'init' hook into the plugin's main file that beacons the site's AUTH_KEY and SECURE_AUTH_KEY to an attacker-controlled C2 server. Using these keys, an attacker can generate a valid HMAC token to bypass authentication via a specific query parameter ('_wplogin'), granting them an active session as the site's primary administrator. The vendor has released version 7.3.0.6 to remediate the distribution channel, but manual cleanup of infected databases (specifically the '_wpc_uid' option and '_wpcs' transient) is required.
Affected products
- Uncanny Owl Uncanny Automator Pro 7.3.0.5
Timeline
- 2026-06-13: patched: Vendor removed attacker access and published clean version 7.3.0.6
- 2026-06-16: disclosed: Public disclosure by WPScan
- 2026-07-07: advisory: NVD publication of CVE-2026-12375