The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7…

The uncanny-automator-pro WordPress plugin versions before 7.3.0.6 were distributed with malicious code following a supply chain compromise of the vendor's update and distribution infrastructure. The injected backdoor allows unauthenticated attackers to obtain administrator-level sessions on affected WordPress sites. Additionally, the malicious code beacons sensitive data including the site's secret keys and administrator credentials to attacker-controlled servers. This represents a critical supply chain attack targeting WordPress site owners who installed or updated the plugin before the patched version 7.3.0.6 was released. Site owners running affected versions should immediately update the plugin, rotate secret keys, and audit administrator accounts for unauthorized access. The vulnerability is tracked as CVE-2026-12375 and has been documented by both NVD and WPScan.