WordPress plugin
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High6
- Medium10
- Low0
All Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion ≤7.6.1.1Update to 7.7.0 | CVE-2026-82627 | |
| High7.5 | Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints ≤7.3.2Update to 7.4.0 | CVE-2026-15025 | |
| High8.1 | Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token ≤7.3.1.4Update to 7.4.0 | CVE-2026-15008 | |
| High8.1 | Unauthenticated PHP Object Injection ≤7.3.1.2Update to 7.3.1.3 | CVE-2026-56031 | |
| High7.2 | Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload ≤7.0.0.3Update to 7.1.0 | CVE-2026-2269 | |
| Critical9.1 | Unauthenticated PHP Object Injection in automator_api_decode_message Function ≤6.4.0.1Update to 6.4.0.2 | CVE-2025-3623 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ≤6.3.0.2Update to 6.4.0 | CVE-2025-2075 |
- High7.5Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
≤7.6.1.1Update to 7.7.0
- High7.5Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
≤7.3.2Update to 7.4.0
- High8.1Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
≤7.3.1.4Update to 7.4.0
- High8.1Unauthenticated PHP Object Injection
≤7.3.1.2Update to 7.3.1.3
- High7.2Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload
≤7.0.0.3Update to 7.1.0
- Critical9.1Unauthenticated PHP Object Injection in automator_api_decode_message Function
≤6.4.0.1Update to 6.4.0.2
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
≤6.3.0.2Update to 6.4.0
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT: common questions
Does Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT: 1 critical, 6 high, 10 medium. None are known to affect version null.
How do I check which version of Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT vulnerability?
CVE-2026-120846, published Nov 3, 2026: Uncanny Automator – Claude & ChatGPT MCP Server with MCP for AI Automation <= 7.7.1 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT vulnerability listed in CISA KEV?
No. None of the known Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT vulnerabilities is currently listed in the CISA KEV catalog.