# CVE-2026-56031: Uncanny Owl Uncanny Automator PHP object injection

Source: https://junglewise.ai/threats/cve-2026-56031-uncanny-owl-uncanny-automator-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-56031 · Severity: high · CVSS 8.1 · Published 2026-06-26

Uncanny Automator, a popular WordPress plugin used to automate workflows between different apps and plugins, is vulnerable to a security flaw that allows unauthorized users to inject malicious data. If exploited, an attacker could potentially take control of the website, steal sensitive data, or disrupt services. This vulnerability is considered high priority because it does not require a login to exploit, though it may depend on specific site configurations.

Technologies: [Uncanny Owl Uncanny Automator](https://junglewise.ai/threats/technologies/uncanny-automator). Vendors: [Uncanny Owl](https://junglewise.ai/threats/vendors/uncanny-owl).

## Quick answers

**Is CVE-2026-56031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56031 being exploited in the wild.

**How severe is CVE-2026-56031?** High severity, with a CVSS score of 8.1, published 26 June 2026.

**Which products and versions are affected?** Uncanny Owl Uncanny Automator <= 7.3.1.2.

**Is there a fix for CVE-2026-56031?** A patch was published on 2026-06-26: Fixed in version 7.3.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56031 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56031?** Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP Object Injection vulnerability exists in the Uncanny Automator plugin for WordPress (versions <= 7.3.1.2) due to improper deserialization of user-supplied input. An unauthenticated remote attacker can exploit this by submitting specially crafted input to a vulnerable endpoint. If a suitable Property-Oriented Programming (POP) chain is present in the environment, this can lead to remote code execution, SQL injection, or arbitrary file deletion. The vulnerability is mitigated in version 7.3.1.3. While unauthenticated, the CVSS vector indicates high complexity (AC:H), suggesting specific preconditions or configurations may be required for successful exploitation.

## Affected products

- Uncanny Owl Uncanny Automator <= 7.3.1.2

## Timeline

- 2026-06-08: other: Reported by researcher VanTastic
- 2026-06-23: advisory: Patchstack advisory published
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fixed in version 7.3.1.3

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-1-2-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-1-2-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [Uncanny Owl Uncanny Automator broken access control](https://junglewise.ai/threats/cve-2026-120846-missing-authorization-vulnerability-in-uncanny-owl-uncanny)
- [Uncanny Automator WordPress plugin missing authorization in AJAX actions](https://junglewise.ai/threats/cve-2026-15025-uncanny-automator-wordpress-plugin-missing-authorization-in-ajax)
- [Uncanny Owl Uncanny Automator SQL injection](https://junglewise.ai/threats/cve-2026-65462-uncanny-owl-uncanny-automator-sql-injection)
- [Uncanny Automator arbitrary file deletion via insecure deserialization](https://junglewise.ai/threats/cve-2026-15008-uncanny-automator-arbitrary-file-deletion-via-insecure)