Uncanny Automator Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Uncanny Automator WordPress plugin, affecting all versions through 6.3.0.2. The issue arises because the add_role() and user_role() functions lack proper capability checks, allowing unauthenticated users to assign the administrator role to any user. While this grants full access to the site, the vulnerability requires an active account, categorizing it as an authenticated privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative privileges on the WordPress site, granting them full control.

Remediation

Users are advised to update the Uncanny Automator plugin to version 6.4.0 or later.