CVE-2026-82627

Name of the Vulnerable Software and Affected Versions Uncanny Automator – AI + Automation for WordPress versions prior to 7.6.1.2

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated users with Subscriber-level access or higher can inject a PHP Object when a third-party integration plugin is installed and a recipe is configured to store attacker-controlled data as trigger meta. The presence of a POP chain (Property-Oriented Programming, a technique used to execute code by leveraging existing classes in the application) allows attackers to delete arbitrary files on the server.

Recommendations Update Uncanny Automator – AI + Automation for WordPress to version 7.6.1.2 or later.