# CVE-2026-12375: Uncanny Owl Uncanny Automator Pro supply chain compromise and backdoor

Source: https://junglewise.ai/threats/cve-2026-12375-uncanny-owl-uncanny-automator-pro-supply-chain-compromise-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-12375 · Severity: info · CVSS 10 · Published 2026-07-07

The Uncanny Automator Pro plugin for WordPress was distributed with malicious code after the vendor's update servers were compromised. This backdoor allows unauthorized individuals to gain full administrative control over a website and steals sensitive security keys. Because the malicious code was delivered through an official update channel, affected sites may have been compromised automatically.

Vendors: [Uncanny Owl](https://junglewise.ai/threats/vendors/uncanny-owl).

## Quick answers

**Is CVE-2026-12375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12375 being exploited in the wild.

**How severe is CVE-2026-12375?** Informational severity, with a CVSS score of 10, published 7 July 2026.

**Which products and versions are affected?** Uncanny Owl Uncanny Automator Pro 7.3.0.5.

**Is there a fix for CVE-2026-12375?** A patch was published on 2026-06-13: Vendor removed attacker access and published clean version 7.3.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12375 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12375?** Check whether you run Uncanny Owl Uncanny Automator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A supply chain compromise of the Uncanny Owl update server led to the distribution of a trojanized version of Uncanny Automator Pro (v7.3.0.5). The malicious code injects an 'init' hook into the plugin's main file that beacons the site's AUTH_KEY and SECURE_AUTH_KEY to an attacker-controlled C2 server. Using these keys, an attacker can generate a valid HMAC token to bypass authentication via a specific query parameter ('_wplogin'), granting them an active session as the site's primary administrator. The vendor has released version 7.3.0.6 to remediate the distribution channel, but manual cleanup of infected databases (specifically the '_wpc_uid' option and '_wpcs' transient) is required.

## Affected products

- Uncanny Owl Uncanny Automator Pro 7.3.0.5

## Timeline

- 2026-06-13: patched: Vendor removed attacker access and published clean version 7.3.0.6
- 2026-06-16: disclosed: Public disclosure by WPScan
- 2026-07-07: advisory: NVD publication of CVE-2026-12375

## References

- [https://wpscan.com/vulnerability/ddc83705-3df6-427c-957b-935135330f73/](https://wpscan.com/vulnerability/ddc83705-3df6-427c-957b-935135330f73/)

## Related threats

- [Uncanny Owl Uncanny Automator Pro PHP Object Injection](https://junglewise.ai/threats/cve-2026-56057-uncanny-owl-uncanny-automator-pro-php-object-injection)