Uncanny Automator Pro Hacked: Update Now

If your site runs Uncanny Automator Pro, update it right now: versions before 7.3.0.6 were distributed with a backdoor that lets anyone on the internet log into your site as an administrator, with no password needed.

This is for owners of small WordPress sites who use Uncanny Automator Pro (the paid version of the popular automation plugin that connects forms, LMS platforms, membership tools, and other WordPress features without custom code). Here's what you'll get: a plain-English breakdown of what CVE-2026-12375 actually is, whether your site is affected, the exact update steps, and how to check whether anyone already got in.

What actually happened

This wasn't a coding mistake buried in the plugin's logic. According to the National Vulnerability Database entry for CVE-2026-12375, the vendor's own update and distribution infrastructure for uncanny-automator-pro was compromised. Attackers used that access to slip malicious code directly into the plugin before it ever reached customer sites.

That makes this a supply chain attack: instead of hacking thousands of individual WordPress sites one at a time, the attacker compromised the thing that feeds code to all of them at once. If you installed or auto-updated to an affected build, the backdoor came in through your normal, trusted update process. You didn't do anything wrong by keeping your plugins updated; the update itself was the problem.

The injected code does two things, per the NVD description:

1. It grants an unauthenticated administrator session to anyone who knows how to trigger it, meaning an attacker doesn't need a username, password, or any login at all to get full admin control of your site.
2. It beacons your site's secret keys and administrator details to attacker-controlled servers, so even if you later lock the front door, the attacker may already have copies of the keys needed to walk back in.

How serious is this, really

This one is about as bad as WordPress vulnerabilities get. NVD scored it CVSS 9.8, which sits in the Critical band (9.0 to 10.0).

In short: no password, no clicks, no special skill required, and the attacker gets everything. That combination is exactly why this is being treated as an emergency patch, not a routine update.

The flaw was published to NVD on 2026-07-07 and currently carries an "Deferred" analysis status, which just means NVD hasn't finished its own detailed write-up yet. It doesn't mean the vulnerability is unconfirmed or low-risk; the core facts (backdoor, unauthenticated admin access, data exfiltration) are already documented. WPScan has also catalogued it independently in its vulnerability database.

Who is affected

Based on the official description, the affected software is:

• Plugin: Uncanny Automator Pro (uncanny-automator-pro)
• Affected versions: all versions before 7.3.0.6
• Fixed version: 7.3.0.6 and later

The free (non-Pro) Uncanny Automator plugin is a separate codebase from Uncanny Automator Pro; the NVD record is specific to the Pro add-on. If you only run the free version, this particular CVE doesn't apply to you, but it's still worth checking your plugin list for both, since many sites run them together.

If your version number shows as 7.3.0.6 or higher in Plugins > Installed Plugins, you're already on a fixed build. If it's lower, or you're not sure, treat it as affected until you confirm otherwise.

The exact action to take

Do these in order. None of them require developer skills.

1. Log into wp-admin and go to Plugins > Installed Plugins. Find Uncanny Automator Pro and note the version number shown underneath it.
2. If it's below 7.3.0.6, update immediately. Click "Update now" if WordPress shows an update available. If no update appears yet, download the latest build directly from your Automator Pro account dashboard or AppSumo/vendor portal rather than waiting on auto-update.
3. If you can't confirm a clean, vendor-issued 7.3.0.6+ build, delete and reinstall the plugin from scratch using a freshly downloaded copy from the official vendor source, not a cached or mirrored copy from a third-party site.
4. Rotate your WordPress secret keys. Since the backdoor specifically targeted secret keys, generate new ones using the WordPress.org secret key generator and replace the matching lines in your site's wp-config.php file. This immediately invalidates any session cookies the attacker may have forged.
5. Force a password reset for every administrator account, and enable two-factor authentication if you haven't already.
6. Check for new or unfamiliar admin users under Users > All Users. Delete any account you don't recognize, especially ones created recently.
7. Review your site's outbound connections and file changes for anything unexplained, like new files in wp-content, unexpected scheduled tasks (cron jobs), or unfamiliar entries in your hosting error logs. If you're not comfortable doing this yourself, a professional review will catch things a quick look won't.

How do I know if I was already hacked

This is the question we hear most after news like this breaks, and it's a fair one if you've been running an older version for a while. A few signs worth checking right away:

• Admin accounts you didn't create, or existing accounts with changed emails/passwords
• Unexpected redirects when visitors land on your homepage
• New files appearing in wp-content/uploads or wp-content/plugins that you didn't add
• Your site flagged by Google Safe Browsing or your host's malware scanner
• Outgoing traffic to unfamiliar domains, visible in your hosting control panel's logs

Our guide on how to tell if your website is hackable walks through the warning signs in more depth, and if you're already seeing symptoms, our what to do when your website is hacked guide covers containment steps before you touch anything else.

Why this keeps happening with WordPress plugins

WordPress powers a huge share of the web, and plugins are how most small sites add functionality without hiring a developer. That convenience is also the attack surface: a single compromised plugin update, pushed through a trusted channel, can reach every site that installed it. This is part of why "WordPress plugin backdoor" incidents show up in security news fairly regularly; the vendor's build pipeline, not just the plugin's code, is now a target worth defending.

An automated vulnerability scanner can flag that a plugin version is outdated, but it generally can't tell you whether a backdoor like this one actually executed on your specific site, created a hidden admin account, or already exfiltrated your keys. That gap between "the plugin had a known flaw" and "did it actually happen to me" is exactly where a manual look by a real person adds value: checking actual admin user lists, file timestamps, and outbound connections against what should be there, not just matching version numbers.

If you want to understand the difference between what a scanner catches and what a person catches, our guide to manual vs automated penetration testing breaks it down without the sales pitch.

Key takeaways

• Uncanny Automator Pro versions before 7.3.0.6 shipped with a backdoor after the vendor's update infrastructure was compromised; this is CVE-2026-12375, CVSS 9.8 (Critical).
• The backdoor lets unauthenticated attackers get full admin access and steals your site's secret keys, so updating alone isn't enough; rotate your keys and reset admin passwords too.
• Update to Uncanny Automator Pro 7.3.0.6 or later today, from an official vendor source, and confirm the version number in Plugins > Installed Plugins.
• Check Users > All Users for unfamiliar admin accounts and your hosting logs for strange outbound connections before you assume you're clean.
• A free pass/fail check on critical issues takes a few minutes if you're not sure where you stand.

If you've run through these steps and want a second set of eyes, or you're just not sure what to look for in your logs and user list, start with our free website security check: it's a quick, no-login look that tells you yes or no on critical issues. If you want a full human audit of everything on your site (not just this one plugin), a one-time manual review runs $49; see pricing for what's included.