Summary
CVE-2026-12375 describes a supply chain attack against the Uncanny Automator Pro WordPress plugin (uncanny-automator-pro). The vendor’s plugin distribution infrastructure was compromised on June 12, 2026, resulting in a backdoored build (version 7.3.0.5) being served to customers for approximately 22 hours before a clean replacement (version 7.3.0.6) was published on June 13, 2026. The injected backdoor enables unauthenticated attackers to obtain a full administrator session on any affected WordPress site and exfiltrates site secret keys and administrator credentials to attacker-controlled servers, representing a complete site takeover. This vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: The vendor’s update and distribution infrastructure was compromised via a third-party software vulnerability, allowing an attacker to tamper with the plugin package and inject malicious code into the distributed 7.3.0.5 build. Version 7.3.0.5 does not appear in the official vendor changelog (version history jumps from 7.3.0.4 directly to 7.3.0.6).
- Backdoor mechanism: The injected code registers an unauthenticated "magic login" handler via WordPress
inithooks. It computes an HMAC token using the site’sAUTH_KEYandSECURE_AUTH_KEYconstants (hash_hmac('sha256', 'magic_login', AUTH_KEY . SECURE_AUTH_KEY)) and logs any attacker presenting the correct token in as the first administrator user on the site. - Data exfiltration: Upon activation, the backdoor beacons the site’s authentication secret keys and administrator account details to two attacker-controlled C2 endpoints:
https://tidio.cc/ua/recv.phpandhttp://84.201.6.54/ua/recv.php. - Attack vector: Network-accessible; no authentication or user interaction required. Any WordPress site that auto-updated to version 7.3.0.5 during the ~22-hour distribution window is potentially fully compromised.
- Impact: Full unauthenticated administrator session grant (complete site takeover), plus exfiltration of site secret keys and administrator credentials. The vendor additionally confirmed that the attacker accessed the customer database, exposing customer names, email addresses, license keys, and associated website URLs.
- Indicators of Compromise (IoCs): Presence of WordPress option
_wpc_uidor transient_wpcs; unauthenticated HTTP requests containing the_wploginquery parameter; outbound network requests totidio.cc/ua/recv.phpor84.201.6.54/ua/recv.php; injectedinit-hook code inuncanny-automator-pro.php.
Affected software
- Uncanny Automator Pro (
uncanny-automator-pro) version 7.3.0.5 (backdoored build served approximately 6:30 PM EDT June 12, 2026 through 4:00 PM EDT June 13, 2026) - The vendor states that less than 6% of active installations received the tampered build
- The free Uncanny Automator Lite plugin was not affected
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate – Update: Upgrade to Uncanny Automator Pro version 7.3.0.6 or later using only the official WordPress plugin updater, your Uncanny Automator account dashboard, or the WordPress.org repository. Do not install updates from any third-party source, as version 7.3.0.5 may continue to circulate from unauthorized channels.
- Treat affected sites as fully compromised: The vendor explicitly states that simply reinstalling or updating the plugin is insufficient for sites that received the backdoored build. Any site that ran version 7.3.0.5 should be treated as fully compromised and undergo a complete incident response process.
- Rotate all credentials and secrets: Reset all WordPress administrator account passwords, and regenerate WordPress secret keys and salts (via
wp-config.phpor the WordPress secret key generator). Invalidate all active sessions. - Audit for IoCs: Check for the presence of the
_wpc_uidoption or_wpcstransient in the WordPress database, and review server logs for outbound connections totidio.ccor84.201.6.54and for requests containing the_wploginparameter. - Monitor for phishing: The vendor warns that attacker access to the customer database may result in targeted phishing campaigns impersonating Uncanny Automator; treat unsolicited communications requesting credentials or update actions with heightened suspicion.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

