Live › vulnerability › CVE-2026-120846
Uncanny Automator, a WordPress automation plugin, has a missing authorization check that lets a user reach functions they should not be allowed to use. The sources do not say exactly what data or actions an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the Uncanny Automator WordPress plugin at version 7.7.1 or earlier are affected. The sources do not say which features or roles need to be enabled for the flaw to be reachable.
No product ranges from the sources yet.
wp plugin get uncanny-automator --field=version7.7.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-120846")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.