Is CVE-2026-56057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56057 being exploited in the wild.

How severe is CVE-2026-56057?

Critical severity, with a CVSS score of 9.8, published 26 June 2026.

Which products and versions are affected?

Uncanny Owl Uncanny Automator Pro <= 7.3.0.6.

Is there a fix for CVE-2026-56057?

A patch was published on 7.3.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56057 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56057?

Check whether you run Uncanny Owl Uncanny Automator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56057: Uncanny Owl Uncanny Automator Pro PHP Object Injection

Q: Is there a fix for CVE-2026-56057?

A patch was published on 7.3.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56057 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56057?

Check whether you run Uncanny Owl Uncanny Automator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56057 · Severity: critical · CVSS 9.8 · Published 2026-06-26

Uncanny Automator Pro is a WordPress plugin used to create automated workflows between different apps and plugins. A critical security flaw allows remote attackers to inject malicious code into the website. If exploited, this could lead to full site takeover, data theft, or the complete deletion of website content.

Vendors: Uncanny Owl.

Quick answers

Is CVE-2026-56057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56057 being exploited in the wild.
How severe is CVE-2026-56057?: Critical severity, with a CVSS score of 9.8, published 26 June 2026.
Which products and versions are affected?: Uncanny Owl Uncanny Automator Pro <= 7.3.0.6.
Is there a fix for CVE-2026-56057?: A patch was published on 7.3.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56057 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56057?: Check whether you run Uncanny Owl Uncanny Automator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PHP Object Injection vulnerability exists in Uncanny Automator Pro versions up to and including 7.3.0.6. The flaw stems from the deserialization of untrusted data (CWE-502), which can be triggered by an unauthenticated user. If a suitable Property-Oriented Programming (POP) chain is present on the server, an attacker can leverage this to execute arbitrary code, perform SQL injection, or achieve path traversal. The vulnerability is resolved in version 7.3.0.7.

Affected products

Uncanny Owl Uncanny Automator Pro <= 7.3.0.6

Timeline

2026-06-18: other: Reported by VanTastic
2026-06-25: advisory: Patchstack advisory published
2026-06-26: disclosed: NVD publication date
7.3.0.7: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.