PLUGIN SECURITY
Is Uncanny Automator safe?
Claude, ChatGPT, Gemini or any AI agent runs your site through MCP and automates any task as a workflow. Automation engine built in.
What this plugin does
- Slug:
uncanny-automator - Author: Uncanny Owl
- 40000+ active installs
- 98/100 rating (157 reviews on wordpress.org)
- 2672326 all-time downloads
- On WordPress.org since 2020-04-14
AIautomationChatGPTClaudemcp-server
Maintenance status
- Latest known version: 7.5.0.3
- Last updated: 2026-11-06 2:30am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
Known vulnerabilities
16 known CVEs on file for Uncanny Automator.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-120846 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 8.0.0 | — | Medium 5.3 | < 8.0.0 | 8.0.0 | 2026-10-07 | ⚠ update needed |
| CVE-2026-15025 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.4.0 | Missing Authorization | High 7.5 | < 7.4.0 | 7.4.0 | 2026-07-27 | ✓ fixed in latest |
| CVE-2026-82627 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.7.0 | Deserialization of Untrusted Data | High 7.5 | < 7.7.0 | 7.7.0 | 2026-07-27 | ⚠ update needed |
| CVE-2026-15008 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.4.0 | Deserialization of Untrusted Data | High 8.1 | < 7.4.0 | 7.4.0 | 2026-07-15 | ✓ fixed in latest |
| CVE-2026-56031 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.3.1.3 | Deserialization of Untrusted Data | High 8.1 | < 7.3.1.3 | 7.3.1.3 | 2026-06-23 | ✓ fixed in latest |
| CVE-2025-15522 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.0.0 | 7.0.0 | 2026-01-22 | ✓ fixed in latest |
| CVE-2025-66056 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.10.0 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Medium 4.3 | < 6.10.0 | 6.10.0 | 2025-11-07 | ✓ fixed in latest |
| CVE-2025-58193 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.8.0 | Missing Authorization | Medium 4.3 | < 6.8.0 | 6.8.0 | 2025-08-27 | ✓ fixed in latest |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-48133 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.5.0 | Missing Authorization | Critical 9.8 | < 6.5.0 | 6.5.0 | 2025-06-02 | ✓ fixed in latest |
| CVE-2024-13838 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.3 | Server-Side Request Forgery (SSRF) | Medium 5.5 | < 6.3 | 6.3 | 2025-03-11 | ✓ fixed in latest |
| CVE-2023-52151 | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 5.1.0.3 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.1.0.3 | 5.1.0.3 | 2023-12-28 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 4.15 | — | Unknown | < 4.15 | 4.15 | 2023-05-25 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 4.15 | — | Unknown | < 4.15 | 4.15 | 2023-05-24 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.4.0 | Missing Authorization | High 8.8 | < 6.4.0 | 6.4.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.5.0 | Missing Authorization | Medium 4.3 | < 6.5.0 | 6.5.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.4.0.2 | Deserialization of Untrusted Data | Critical 9.1 | < 6.4.0.2 | 6.4.0.2 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.1.0 | — | Unknown | < 7.1.0 | 7.1.0 | 0000-00-00 | ✓ fixed in latest |
| — | Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.4.0 | — | Unknown | < 7.4.0 | 7.4.0 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-2075 | Uncanny Automator < 6.4.0 - Subscriber+ Privilege Escalation | — | Unknown | < 6.4.0 | 6.4.0 | — | ✓ fixed in latest |
| CVE-2025-3623 | Uncanny Automator < 6.4.0.2 - Unauthenticated PHP Object Injection in automator_api_decode_message Function | — | Unknown | < 6.4.0.2 | 6.4.0.2 | — | ✓ fixed in latest |
| CVE-2025-4520 | Uncanny Automator < 6.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update | — | Unknown | < 6.5.0 | 6.5.0 | — | ✓ fixed in latest |
| CVE-2026-2269 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 7.1.0 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload | — | Unknown | < 7.1.0 | 7.1.0 | — | ✓ fixed in latest |
| CVE-2026-65462 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 7.4.0 - Authenticated (Administrator+) SQL Injection | — | Unknown | < 7.4.0 | 7.4.0 | — | ✓ fixed in latest |
How to fix it
Keep Uncanny Automator updated — 7.5.0.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7323)
- Jetpack – AI Agents & MCP, Security, Backup & Analytics — 3000000+ active installs — 74/100 (2409)
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — 2000000+ active installs — 94/100 (5233) — max PHP 8.4
- AI Agent by SiteGround — 1000000+ active installs — 34/100 (98) — max PHP <8.0
- Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates — 600000+ active installs — 98/100 (1680) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.