CVE-2025-66056

Executive Summary

CVE-2025-66056 is a medium-severity information disclosure vulnerability affecting the Uncanny Automator WordPress plugin by Uncanny Owl. The flaw allows an unauthenticated attacker to retrieve embedded sensitive data from the plugin’s internal state, exposing system information that should be restricted. This is classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-200). The vulnerability impacts all versions prior to 6.10.0. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for exposed WordPress installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or via Composer/WPackagist are affected. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low confidentiality impact reflects that only specific embedded sensitive data (e.g., internal paths, configuration snippets) is exposed, not full database credentials or user data. However, this information can aid further attacks.

Deep Dive & Mechanics

The Uncanny Automator plugin provides automation workflows between WordPress and third-party services. The vulnerability stems from improper access controls on a REST API endpoint or AJAX handler that returns internal plugin state data. An unauthenticated attacker can send a crafted HTTP request to a specific endpoint (e.g., /wp-json/uncanny-automator/v1/...) to retrieve sensitive system information such as:

• Internal file paths
• Plugin configuration details
• Debug logs or error messages containing stack traces
• Nonce values or other tokens

The root cause is the lack of capability checks or nonce verification on the affected endpoint. The plugin fails to validate whether the requesting user has the necessary permissions (e.g., manage_options) before returning sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is inferred from the plugin’s REST API registration. The vulnerable version likely contains code similar to:

// Vulnerable: No permission check
register_rest_route('uncanny-automator/v1', '/system-info', array(
    'methods' => 'GET',
    'callback' => 'get_system_info',
    'permission_callback' => '__return_true' // or missing
));

A patched version would include a proper permission callback:

// Patched: Requires admin privileges
register_rest_route('uncanny-automator/v1', '/system-info', array(
    'methods' => 'GET',
    'callback' => 'get_system_info',
    'permission_callback' => function() {
        return current_user_can('manage_options');
    }
));

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Uncanny Automator < 6.10.0 installed and active.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common endpoints include:

   • /wp-json/uncanny-automator/v1/system-info
   • /wp-json/uncanny-automator/v1/debug
   • /wp-json/uncanny-automator/v1/config

2. Send a GET request to the endpoint:

curl -X GET "https://target.com/wp-json/uncanny-automator/v1/system-info" -v

3. Parse the response for sensitive data such as:
   • ABSPATH or WP_CONTENT_DIR paths
   • Database table prefixes
   • Plugin version and active integrations
   • Debug logs with stack traces

Example Response (simulated):

{
  "plugin_version": "6.9.9",
  "wp_path": "/var/www/html",
  "debug_log": [
    "2025-01-15 10:00:00 - Error: Undefined index: api_key in /var/www/html/wp-content/plugins/uncanny-automator/src/class-api.php on line 45"
  ]
}

Blue Team

Detection:

• Monitor for unauthorized access to /wp-json/uncanny-automator/v1/* endpoints from unauthenticated IPs.
• Look for HTTP 200 responses to these endpoints without a valid X-WP-Nonce header.

Hunting:

• Search web server logs for requests matching the pattern:

  GET /wp-json/uncanny-automator/v1/(system-info|debug|config)
  

• Correlate with IPs that have no prior authenticated session.

Mitigation (temporary):

• Block access to the vulnerable endpoints via .htaccess or web application firewall (WAF) rules:

  RewriteCond %{REQUEST_URI} ^/wp-json/uncanny-automator/v1/(system-info|debug|config) [NC]
  RewriteRule .* - [F,L]
  

• Disable the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /wp-json/uncanny-automator/v1/system-info
  • HTTP GET requests to /wp-json/uncanny-automator/v1/debug
  • HTTP GET requests to /wp-json/uncanny-automator/v1/config
• File:
  • Unusual entries in WordPress debug.log containing plugin internal data.
• Behavioral:
  • Unauthenticated users accessing REST API endpoints that should require admin privileges.

Detection Engineering

YARA Rule

rule CVE_2025_66056_Uncanny_Automator_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66056 in Uncanny Automator plugin"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2025-66056"
    strings:
        $endpoint1 = "/wp-json/uncanny-automator/v1/system-info"
        $endpoint2 = "/wp-json/uncanny-automator/v1/debug"
        $endpoint3 = "/wp-json/uncanny-automator/v1/config"
        $sensitive_data = "ABSPATH" nocase
        $sensitive_data2 = "WP_CONTENT_DIR" nocase
    condition:
        any of ($endpoint*) and any of ($sensitive_data*)
}

Sigma Rule

title: CVE-2025-66056 - Uncanny Automator Sensitive Info Disclosure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to Uncanny Automator REST API endpoints that expose sensitive system information.
author: Valters IT
date: 2025-01-15
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/wp-json/uncanny-automator/v1/system-info'
            - '/wp-json/uncanny-automator/v1/debug'
            - '/wp-json/uncanny-automator/v1/config'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare and authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66056 - Uncanny Automator Sensitive Info Disclosure"; flow:to_server; http.method; content:"GET"; http.uri; content:"/wp-json/uncanny-automator/v1/system-info"; http.uri; content:"/wp-json/uncanny-automator/v1/debug"; http.uri; content:"/wp-json/uncanny-automator/v1/config"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Apply a virtual patch using a WAF to block the vulnerable endpoints.
3. Monitor logs for any exploitation attempts.

Long-Term Fix:

• The vendor (Uncanny Owl) must release a patched version (≥ 6.10.0) that adds proper permission checks to all REST API endpoints.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme’s functions.php to disable the vulnerable endpoints:

add_action('rest_api_init', function() {
    remove_action('rest_api_init', 'uncanny_automator_register_routes');
}, 99);

Note: This workaround may break plugin functionality.

Valters IT
Securing Digital Frontiers