Is CVE-2026-65462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65462 being exploited in the wild.

How severe is CVE-2026-65462?

High severity, with a CVSS score of 7.6, published 23 July 2026.

Which products and versions are affected?

Uncanny Owl Uncanny Automator <= 7.3.2.

Is there a fix for CVE-2026-65462?

A patch was published on 2026-07-23: Version 7.4.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65462 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65462?

Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65462: Uncanny Owl Uncanny Automator SQL injection

Q: Is there a fix for CVE-2026-65462?

A patch was published on 2026-07-23: Version 7.4.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65462 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65462?

Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65462 · Severity: high · CVSS 7.6 · Published 2026-07-23

Uncanny Automator is a popular WordPress plugin used to create automated workflows between different apps and plugins. A security vulnerability in versions 7.3.2 and earlier could allow an administrative user to execute unauthorized database commands. This could lead to the exposure of sensitive site information or unauthorized modification of the database.

Technologies: Uncanny Owl Uncanny Automator. Vendors: Uncanny Owl.

Quick answers

Is CVE-2026-65462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65462 being exploited in the wild.
How severe is CVE-2026-65462?: High severity, with a CVSS score of 7.6, published 23 July 2026.
Which products and versions are affected?: Uncanny Owl Uncanny Automator <= 7.3.2.
Is there a fix for CVE-2026-65462?: A patch was published on 2026-07-23: Version 7.4.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65462 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65462?: Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the Uncanny Automator plugin for WordPress (versions <= 7.3.2) due to improper neutralization of special elements used in SQL commands (CWE-89). The vulnerability is accessible via the network but requires high privileges (Administrator level) to exploit. An attacker with sufficient permissions can bypass intended software logic to query or modify the underlying WordPress database. The issue is resolved in version 7.4.0.

Affected products

Uncanny Owl Uncanny Automator <= 7.3.2

Timeline

2026-06-30: other: Reported by researcher Ananda Dhakal
2026-07-22: advisory: Patchstack advisory published
2026-07-23: disclosed: NVD publication date
2026-07-23: patched: Version 7.4.0 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.