Uncanny Automator vulnerabilities

The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.

The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.

The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.