CVE-2026-15025
HighCVSS 7.5Summary
The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.
Risk Assessment
Attackers can access sensitive contact data and integration configurations set by the administrator, and unnecessarily consume third-party API quota.
Recommendation
Update the Uncanny Automator plugin to the latest available version that includes security fixes.
Other vulnerabilities in Uncanny Automator
See all- CVE-2026-65462High
The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.
- CVE-2026-15008High
The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.
Original NVD description (English source)
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.