A high-severity vulnerability in the Uncanny Automator plugin for WordPress allows authenticated administrators to perform Server-Side Request Forgery and potentially achieve remote code execution.

The plugin contains a Server-Side Request Forgery (SSRF) flaw in the download_url() function, which also facilitates the storage of arbitrary remote files on the server. This vulnerability requires Administrator-level authentication or higher to exploit.

Successful exploitation of this vulnerability poses a severe risk to the integrity and availability of the affected WordPress instance. By leveraging SSRF to interact with internal services and using the file upload capability to place malicious scripts on the server, an attacker can gain full control over the web application. With a CVSS score of 7.2, this issue is classified as High, reflecting the significant potential for unauthorized access and system compromise.

Immediate Action: Update the Uncanny Automator plugin to the latest version available from the vendor repository, ensuring that version 7.0.0.3 or higher is superseded by the current patched release.

Proactive Monitoring: Monitor server access logs for unusual outbound requests originating from the web server and audit the uploads directory for unexpected file types or scripts.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict external requests from the server and enforce strict file upload validation policies to block unauthorized file extensions.

Public Exploit Available: Unknown.

Given the potential for remote code execution via file upload, immediate patching is essential to secure the environment. Administrators should verify the plugin version and apply the vendor-provided update without delay, as the combination of SSRF and arbitrary file storage provides a powerful vector for full system takeover.