CVE-2026-56057: WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the WordPress Uncanny Automator Pro plugin (versions up to and including 7.3.0.6) allows an unauthenticated remote attacker to inject malicious serialized PHP objects through the network without any user interaction. Depending on the PHP classes available in the application (a "POP chain"), successful exploitation can result in remote code execution, arbitrary file read or write, or full data compromise. No fix version has been published yet; HarborGuard is tracking the upstream advisory and will make a patched rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is reachable over the network; an attacker must be able to send HTTP requests to the WordPress installation to deliver the malicious payload.

• AuthenticationNot required

  No account or credentials are required; the injection can be triggered by an anonymous request.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker interacts directly with the server.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of environmental layout beyond locating the vulnerable endpoint.

Blast Radius

• Reads arbitrary application data including WordPress database credentials, user session tokens, and any secrets stored on the filesystem accessible to the web process.
• Writes or overwrites arbitrary files reachable by the web server process, enabling backdoor placement or defacement of site content.
• Executes arbitrary operating system commands on the host if a suitable POP chain exists among the installed PHP classes, which is common in WordPress environments with many plugins.
• Fully compromises the integrity and availability of the WordPress installation, including the ability to create admin accounts or drop database tables.