CVE-2025-3623: Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automatorapidecodemessage() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3623?
CVE-2025-3623 is considered a critical vulnerability due to its potential for PHP Object Injection which could be exploited by authenticated attackers.
How do I fix CVE-2025-3623?
To mitigate CVE-2025-3623, users should update the Uncanny Automator plugin to version 6.4.0.2 or later.
Who is affected by CVE-2025-3623?
CVE-2025-3623 affects all versions of the Uncanny Automator plugin for WordPress up to and including 6.4.0.1.
What type of attack does CVE-2025-3623 enable?
CVE-2025-3623 enables authenticated attackers to exploit PHP Object Injection to potentially gain unauthorized access or execute arbitrary code.
What function is vulnerable in CVE-2025-3623?
The vulnerability in CVE-2025-3623 arises from the automator_api_decode_message() function which improperly handles untrusted input.