An authenticated SQL injection vulnerability in the Uncanny Automator WordPress plugin requires immediate attention to prevent unauthorized database interaction.

This is an SQL injection vulnerability (CWE-89) that allows an authenticated user with administrative privileges to execute arbitrary SQL commands. The flaw exists due to improper neutralization of special elements in database queries.

Successful exploitation could allow an administrative user to read, modify, or delete sensitive data stored in the WordPress database. While the CVSS score of 7.6 reflects a high severity, it is important to note that exploitation requires existing administrative access to the platform.

Immediate Action: Update the Uncanny Automator plugin to version 7.4.0 or the latest available release immediately.

Proactive Monitoring: Review database query logs for unusual or unauthorized SQL statements that deviate from normal plugin operation.

Compensating Controls: Ensure that database user permissions follow the principle of least privilege to limit the potential scope of an SQL injection attack.

Public Exploit Available: No

Organizations using the Uncanny Automator plugin should verify their current version and upgrade to 7.4.0 as a priority. Maintaining updated plugins is critical to protecting the WordPress environment from elevated privilege attacks.