CVE-2026-12375 – Supply Chain Backdoor / Unauthenticated Administrator Takeover – Uncanny Automat…

Summary

CVE-2026-12375 describes a supply chain attack against the Uncanny Automator Pro WordPress plugin (uncanny-automator-pro). The vendor’s plugin distribution infrastructure was compromised on June 12, 2026, resulting in a backdoored build (version 7.3.0.5) being served to customers for approximately 22 hours before a clean replacement (version 7.3.0.6) was published on June 13, 2026. The injected backdoor enables unauthenticated attackers to obtain a full administrator session on any affected WordPress site and exfiltrates site secret keys and administrator credentials to attacker-controlled servers, representing a complete site takeover. This vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Technical details

• Root cause: The vendor’s update and distribution infrastructure was compromised via a third-party software vulnerability, allowing an attacker to tamper with the plugin package and inject malicious code into the distributed 7.3.0.5 build. Version 7.3.0.5 does not appear in the official vendor changelog (version history jumps from 7.3.0.4 directly to 7.3.0.6).
• Backdoor mechanism: The injected code registers an unauthenticated "magic login" handler via WordPress init hooks. It computes an HMAC token using the site’s AUTH_KEY and SECURE_AUTH_KEY constants (hash_hmac('sha256', 'magic_login', AUTH_KEY . SECURE_AUTH_KEY)) and logs any attacker presenting the correct token in as the first administrator user on the site.
• Data exfiltration: Upon activation, the backdoor beacons the site’s authentication secret keys and administrator account details to two attacker-controlled C2 endpoints: https://tidio.cc/ua/recv.php and http://84.201.6.54/ua/recv.php.
• Attack vector: Network-accessible; no authentication or user interaction required. Any WordPress site that auto-updated to version 7.3.0.5 during the ~22-hour distribution window is potentially fully compromised.
• Impact: Full unauthenticated administrator session grant (complete site takeover), plus exfiltration of site secret keys and administrator credentials. The vendor additionally confirmed that the attacker accessed the customer database, exposing customer names, email addresses, license keys, and associated website URLs.
• Indicators of Compromise (IoCs): Presence of WordPress option _wpc_uid or transient _wpcs; unauthenticated HTTP requests containing the _wplogin query parameter; outbound network requests to tidio.cc/ua/recv.php or 84.201.6.54/ua/recv.php; injected init-hook code in uncanny-automator-pro.php.

Affected software

• Uncanny Automator Pro (uncanny-automator-pro) version 7.3.0.5 (backdoored build served approximately 6:30 PM EDT June 12, 2026 through 4:00 PM EDT June 13, 2026)
• The vendor states that less than 6% of active installations received the tampered build
• The free Uncanny Automator Lite plugin was not affected

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate – Update: Upgrade to Uncanny Automator Pro version 7.3.0.6 or later using only the official WordPress plugin updater, your Uncanny Automator account dashboard, or the WordPress.org repository. Do not install updates from any third-party source, as version 7.3.0.5 may continue to circulate from unauthorized channels.
• Treat affected sites as fully compromised: The vendor explicitly states that simply reinstalling or updating the plugin is insufficient for sites that received the backdoored build. Any site that ran version 7.3.0.5 should be treated as fully compromised and undergo a complete incident response process.
• Rotate all credentials and secrets: Reset all WordPress administrator account passwords, and regenerate WordPress secret keys and salts (via wp-config.php or the WordPress secret key generator). Invalidate all active sessions.
• Audit for IoCs: Check for the presence of the _wpc_uid option or _wpcs transient in the WordPress database, and review server logs for outbound connections to tidio.cc or 84.201.6.54 and for requests containing the _wplogin parameter.
• Monitor for phishing: The vendor warns that attacker access to the customer database may result in targeted phishing campaigns impersonating Uncanny Automator; treat unsolicited communications requesting credentials or update actions with heightened suspicion.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-12375 at NIST
• Vendor Security Incident Notice – Uncanny Automator
• WPScan Vulnerability Database – CVE-2026-12375