CVE-2026-65462
HighCVSS 7.6Summary
The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.
Risk Assessment
The risk is that an administrator can read, modify, or delete the entire database, potentially leading to complete data loss or site takeover.
Recommendation
Update the Uncanny Automator plugin to version 7.3.3 or later, which fixes this vulnerability.
Other vulnerabilities in Uncanny Automator
See all- CVE-2026-15025High
The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.
- CVE-2026-15008High
The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.
Original NVD description (English source)
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.