{"id":"CVE-2026-120846","kind":"vulnerability","aliases":["CVE-2026-120846"],"related":[],"title":"Uncanny Automator WordPress plugin: missing authorization check through version 7.7.1","description":"Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.","summary":"Uncanny Automator, a WordPress automation plugin, has a missing authorization check that lets a user reach functions they should not be allowed to use. The sources do not say exactly what data or actions an attacker can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","uncanny-automator","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Uncanny Automator plugin version in the WordPress admin plugin list, or with `wp plugin get uncanny-automator --field=version`\n- Compare the result against the affected range through `7.7.1`","fix":null,"status":"open","published_at":"2026-11-03T17:18:07+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","triaged_at":"2026-11-03T17:24:23+00:00","updated_at":"2026-11-03T17:24:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T17:24:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Uncanny Automator WordPress plugin: missing authorization check through version 7.7.1","impact":"medium","summary":"Uncanny Automator, a WordPress automation plugin, has a missing authorization check that lets a user reach functions they should not be allowed to use. The sources do not say exactly what data or actions an attacker can reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","uncanny-automator"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions allowed by missing authorization checks","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120846 and the plugin's changelog for the fixed version and the exact affected function.","how_to_check":"- Check the installed Uncanny Automator plugin version in the WordPress admin plugin list, or with `wp plugin get uncanny-automator --field=version`\n- Compare the result against the affected range through `7.7.1`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Uncanny Automator WordPress plugin at version 7.7.1 or earlier are affected. The sources do not say which features or roles need to be enabled for the flaw to be reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4126,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120846':13A,16A '-2026':12A,15A '7.7.1':10A,86C 'access':75C 'action':55B 'affect':80C 'allow':43B,71C 'attack':57B 'author':6A,31B,61C 'autom':2A,20B,23B,26B,67C,70C,82C 'check':7A,32B 'configur':74C 'control':76C 'cve':11A,14A 'data':53B 'exact':51B 'exploit':72C 'function':38B 'incorrect':73C 'issu':79C 'let':34B 'levels.this':78C 'miss':5A,30B,60C 'n/a':84C 'owl':65C 'packag':17B 'plugin':4A,27B 'reach':37B,59B 'say':50B 'secur':77C 'sourc':47B 'uncanni':1A,19B,22B,64C,66C,69C,81C 'uncanny-autom':18B,68C 'use':45B 'user':36B 'version':9A 'vulner':62C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Uncanny Automator WordPress plugin at version 7.7.1 or earlier are affected. The sources do not say which features or roles need to be enabled for the flaw to be reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","uncannyautomator","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120846","severity":null,"published_at":"2026-11-03T17:18:07+00:00","modified_at":"2026-11-03T17:18:07+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","fetched_at":"2026-11-03T17:21:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}