Uncanny Automator PHP Object Injection Vulnerability in WordPress

A PHP Object Injection vulnerability has been identified in the Uncanny Automator plugin for WordPress, affecting all versions through 6.4.0.1. The vulnerability arises from the deserialization of untrusted input in the 'automator_api_decode_message()' function. This flaw allows authenticated attackers with Subscriber-level access and above to inject PHP objects. The presence of a Property-Oriented Programming (POP) chain could enable these attackers to delete arbitrary files.

Impact

Exploitation of this vulnerability allows for PHP Object Injection, which can lead to arbitrary file deletion.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request that includes untrusted data. This data will be deserialized by the 'automator_api_decode_message()' function, allowing the injection of a PHP object. If a POP chain is present, the injected object can be manipulated to delete files on the server.

Remediation

Users are advised to update the Uncanny Automator plugin to version 6.4.0.2 or later.