# CVE-2026-65462: Uncanny Owl Uncanny Automator SQL injection

Source: https://junglewise.ai/threats/cve-2026-65462-uncanny-owl-uncanny-automator-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65462 · Severity: high · CVSS 7.6 · Published 2026-07-23

Uncanny Automator is a popular WordPress plugin used to create automated workflows between different apps and plugins. A security vulnerability in versions 7.3.2 and earlier could allow an administrative user to execute unauthorized database commands. This could lead to the exposure of sensitive site information or unauthorized modification of the database.

Technologies: [Uncanny Owl Uncanny Automator](https://junglewise.ai/threats/technologies/uncanny-automator). Vendors: [Uncanny Owl](https://junglewise.ai/threats/vendors/uncanny-owl).

## Quick answers

**Is CVE-2026-65462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65462 being exploited in the wild.

**How severe is CVE-2026-65462?** High severity, with a CVSS score of 7.6, published 23 July 2026.

**Which products and versions are affected?** Uncanny Owl Uncanny Automator <= 7.3.2.

**Is there a fix for CVE-2026-65462?** A patch was published on 2026-07-23: Version 7.4.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65462 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65462?** Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Uncanny Automator plugin for WordPress (versions <= 7.3.2) due to improper neutralization of special elements used in SQL commands (CWE-89). The vulnerability is accessible via the network but requires high privileges (Administrator level) to exploit. An attacker with sufficient permissions can bypass intended software logic to query or modify the underlying WordPress database. The issue is resolved in version 7.4.0.

## Affected products

- Uncanny Owl Uncanny Automator <= 7.3.2

## Timeline

- 2026-06-30: other: Reported by researcher Ananda Dhakal
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: NVD publication date
- 2026-07-23: patched: Version 7.4.0 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-2-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-2-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Uncanny Owl Uncanny Automator broken access control](https://junglewise.ai/threats/cve-2026-120846-missing-authorization-vulnerability-in-uncanny-owl-uncanny)
- [Uncanny Automator WordPress plugin missing authorization in AJAX actions](https://junglewise.ai/threats/cve-2026-15025-uncanny-automator-wordpress-plugin-missing-authorization-in-ajax)
- [Uncanny Automator arbitrary file deletion via insecure deserialization](https://junglewise.ai/threats/cve-2026-15008-uncanny-automator-arbitrary-file-deletion-via-insecure)
- [Uncanny Owl Uncanny Automator PHP object injection](https://junglewise.ai/threats/cve-2026-56031-uncanny-owl-uncanny-automator-php-object-injection)