PLUGIN SECURITY
Is Uncanny Automator safe?
The AI + Automation plugin for WordPress. Automate workflows across all your plugins and apps, add an AI agent, and build pages with AI — no code.
What this plugin does
- Slug:
uncanny-automator - Author: Uncanny Owl
- 40000+ active installs
- 98/100 rating (156 reviews on wordpress.org)
- 2514426 all-time downloads
- On WordPress.org since 2020-04-14
AIAI agentai assistantautomationworkflow automation
Maintenance status
- Latest known version: 7.5.0.3
- Last updated: 2026-09-01 11:03pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
Known vulnerabilities
14 known CVEs on file for Uncanny Automator.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-15025 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.4.0 | Missing Authorization | High 7.5 | < 7.4.0 | 7.4.0 | 2026-07-27 | ✓ fixed in latest |
| CVE-2026-15008 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.4.0 | Deserialization of Untrusted Data | High 8.1 | < 7.4.0 | 7.4.0 | 2026-07-15 | ✓ fixed in latest |
| CVE-2026-56031 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.3.1.3 | Deserialization of Untrusted Data | High 8.1 | < 7.3.1.3 | 7.3.1.3 | 2026-06-23 | ✓ fixed in latest |
| CVE-2025-15522 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.0.0 | 7.0.0 | 2026-01-22 | ✓ fixed in latest |
| CVE-2025-66056 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.10.0 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Medium 4.3 | < 6.10.0 | 6.10.0 | 2025-11-07 | ✓ fixed in latest |
| CVE-2025-58193 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.8.0 | Missing Authorization | Medium 4.3 | < 6.8.0 | 6.8.0 | 2025-08-27 | ✓ fixed in latest |
| CVE-2025-48133 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.5.0 | Missing Authorization | Critical 9.8 | < 6.5.0 | 6.5.0 | 2025-06-02 | ✓ fixed in latest |
| CVE-2024-13838 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.3 | Server-Side Request Forgery (SSRF) | Medium 5.5 | < 6.3 | 6.3 | 2025-03-11 | ✓ fixed in latest |
+ 13 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-52151 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 5.1.0.3 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.1.0.3 | 5.1.0.3 | 2023-12-28 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 4.15 | — | Unknown | < 4.15 | 4.15 | 2023-05-25 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 4.15 | — | Unknown | < 4.15 | 4.15 | 2023-05-24 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.4.0 | Missing Authorization | High 8.8 | < 6.4.0 | 6.4.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.5.0 | Missing Authorization | Medium 4.3 | < 6.5.0 | 6.5.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 6.4.0.2 | Deserialization of Untrusted Data | Critical 9.1 | < 6.4.0.2 | 6.4.0.2 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.1.0 | — | Unknown | < 7.1.0 | 7.1.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.4.0 | — | Unknown | < 7.4.0 | 7.4.0 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-2075 | Uncanny Automator < 6.4.0 - Subscriber+ Privilege Escalation | — | Unknown | < 6.4.0 | 6.4.0 | — | ✓ fixed in latest |
| CVE-2025-3623 | Uncanny Automator < 6.4.0.2 - Unauthenticated PHP Object Injection in automator_api_decode_message Function | — | Unknown | < 6.4.0.2 | 6.4.0.2 | — | ✓ fixed in latest |
| CVE-2025-4520 | Uncanny Automator < 6.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update | — | Unknown | < 6.5.0 | 6.5.0 | — | ✓ fixed in latest |
| CVE-2026-2269 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 7.1.0 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload | — | Unknown | < 7.1.0 | 7.1.0 | — | ✓ fixed in latest |
| CVE-2026-65462 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 7.4.0 - Authenticated (Administrator+) SQL Injection | — | Unknown | < 7.4.0 | 7.4.0 | — | ✓ fixed in latest |
How to fix it
Keep Uncanny Automator updated — 7.5.0.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — 2000000+ active installs — 94/100 (5202) — max PHP 8.4
- AI Agent by SiteGround — 1000000+ active installs — 32/100 (95) — max PHP <8.0
- Angie – Agentic AI — 100000+ active installs — 62/100 (16) — max PHP 8.4
- AI Engine – The Chatbot, AI Framework & MCP for WordPress — 100000+ active installs — 98/100 (862) — max PHP 8.4
- AI Provider for Anthropic — 50000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.