CVE-2026-15008
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.
Risk Assessment
The risk for the organization is critical as an unauthenticated attacker can delete configuration files or other key resources, potentially leading to full server compromise and data loss.
Recommendation
Immediately update the Uncanny Automator plugin to the latest available version that fixes this vulnerability. Additionally, restrict access to Forminator forms to trusted users only.
Other vulnerabilities in Uncanny Automator
See all- CVE-2026-15025High
The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.
- CVE-2026-65462High
The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.
Original NVD description (English source)
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone', allowing unauthenticated form submissions to supply the malicious serialized payload; a gadget chain is present within the plugin via the Action_Helpers_Email __destruct() method, meaning no external gadget library is required.