CVE-2026-15025 in Uncanny Automator Plugin
Summary
by MITRE • 07/28/2026
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in the Uncanny Automator plugin represents a critical authorization flaw that undermines the security model of WordPress sites relying on this automation tool. This issue affects versions up to and including 7.3.2 and stems from insufficient access controls within four specific AJAX endpoints designed for integration with external services. The affected actions include automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields which are intended to facilitate data retrieval from Google Contacts and Mautic platforms. These endpoints lack proper capability checks and nonce verification mechanisms that should prevent unauthorized access to sensitive integration data.
The technical implementation flaw manifests in the absence of authorization validation within the corresponding handler functions ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields. This missing security layer allows authenticated users with Subscriber-level privileges or higher to exploit these endpoints without proper authentication. The vulnerability classification aligns with CWE-863, which addresses "Incorrect Authorization" issues where access control checks are either missing or improperly implemented. From an operational perspective, this weakness enables attackers to enumerate sensitive data structures including Google Contacts groups and labels, Mautic segments and tags, and contact field definitions that have been configured by administrators through the plugin's integration settings.
The impact of this vulnerability extends beyond simple information disclosure as it allows for the consumption of third-party API quotas through legitimate integration credentials. Attackers can repeatedly query these endpoints to exhaust API limits, potentially causing service disruptions or increased costs for affected organizations. This represents a significant concern for businesses relying on cloud-based services where API usage translates directly into operational expenses. The vulnerability also enables attackers to map out the structure of integrated systems, providing them with valuable intelligence for future attacks targeting these platforms. From an attack framework perspective, this issue aligns with ATT&CK technique T1528, which covers "Steal Application Access Token" and related reconnaissance activities that leverage legitimate credentials to access sensitive data.
The security implications are particularly severe given that the affected plugin is commonly used in business environments where integration with customer relationship management systems and contact management platforms is essential. The vulnerability essentially allows attackers to gain visibility into the complete structure of integrated marketing automation systems, potentially exposing organizational data patterns and workflows. Organizations using this plugin should immediately implement mitigations including updating to version 7.3.3 or later, which addresses these authorization gaps through proper capability checks and nonce validation. Additionally, administrators should review user permissions and consider implementing additional access controls around AJAX endpoints to prevent similar issues in other plugins or custom implementations. The vulnerability demonstrates the importance of comprehensive security testing for integration points and highlights the need for robust authorization mechanisms even within authenticated user contexts where access control should still be enforced based on appropriate privileges and capabilities.