CVE-2026-82627CWE-502insecure-deserialization

CVE-2026-82627

High · published October 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-08T06:16Z
References (2)
https://plugins.trac.wordpress.org/changeset/3721435/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ce918263-dc4a-4db1-a506-a9e6c8125741?source=cve · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 01:26Z
    Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
    cvelistv5
  • 08 OCT 01:26Z
    Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
    cvelistv5