CVE-2025-48133 is a medium severity missing authorization flaw (CVSS 6.5) in the Uncanny Automator WordPress plugin. It affects versions up to and including 6.4.0.2, and the record says it allows exploiting incorrectly configured access control security levels. Update the plugin and confirm the fixed release in its changelog.
What's affected
Per the CVE record, Uncanny Automator (plugin slug uncanny-automator) is affected in versions from n/a through 6.4.0.2. Every release up to and including 6.4.0.2 is in scope.
The record describes a missing authorization vulnerability. It is filed under CWE-862 (Missing Authorization). The text is brief, and it does not say which function lacks the check or what an attacker can do with it beyond the impact in the vector.
The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L: reachable over the network, no privileges, no interaction, with low impact on integrity and low impact on availability, and none on confidentiality. That is why the score is medium.
The record does not name a fixed version, and the only reference is a Patchstack database entry. Use the plugin changelog and that entry to confirm the release that closes the issue.
How to check if you're exposed
Plugins are listed with their versions in the WordPress admin under Plugins. From the command line, with WP-CLI:
wp plugin list --name=uncanny-automator --fields=name,version,status
Run it on every site you manage, including staging copies and sites that are not actively edited. A plugin that is installed but inactive is still on disk, and some flaws can be reached whether or not the plugin is switched on, so remove plugins you do not use.
Then compare the version you see with the affected range above. If you manage many sites, a plugin inventory from your management tool or a dependency scan will save time.
What to do now
- Update Uncanny Automator to the newest release, and read the changelog for the entry that covers this issue.
- Review the automations ("recipes") on your site, and remove any you do not use. They run actions on events, so unneeded ones add risk.
- Check which user roles can create or edit automations, and remove rights from roles that do not need them.
- Look at recent activity in the plugin logs and in WordPress for changes nobody on the team made.
- If you manage many sites, check that auto updates for security releases are switched on.
- Test critical automations after the update, such as order or membership flows.
Why it matters
Authorization asks a simple question on every action: is this user allowed to do this? A missing authorization flaw means a function that should ask that question does not, so anyone who can reach it can use it. Authentication, which checks who you are, is a separate step, and a site can have a perfectly good login and still have an endpoint that forgets to ask what the user may do.
The class is a common one for WordPress plugins, because they register many endpoints that run on behalf of different roles. The fix is a capability check on every one of them.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. With a medium score and a short description, this is a good example of a finding to patch on the normal schedule, not an emergency. The effort is a plugin update.
Quick check
Is a medium score safe to ignore?
Not safe to ignore. It means the impact is limited, not absent. Plugin updates are quick, so apply this one in your next maintenance window.
Which release fixes it?
The record gives no fixed version. Check the plugin changelog and the Patchstack entry listed in the record.
Sources
Last reviewed: 18 October 2026.
