CVE-2025-2075: Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole() and userrole() functions missing proper capability checks performed through the validaterestcall() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2075?
CVE-2025-2075 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2025-2075?
To fix CVE-2025-2075, update the Uncanny Automator plugin to version 6.3.0.3 or later.
What versions are affected by CVE-2025-2075?
CVE-2025-2075 affects all versions of the Uncanny Automator plugin up to and including 6.3.0.2.
What type of vulnerability is CVE-2025-2075?
CVE-2025-2075 is a privilege escalation vulnerability that allows unauthorized users to gain elevated permissions.
Who is impacted by CVE-2025-2075?
Users of the Uncanny Automator plugin for WordPress are impacted by CVE-2025-2075 if they are running an affected version.