CVE-2026-15025: Missing Authorization in Uncanny Automator WordPress Plugin

CVE-2026-15025 identifies a critical Missing Authorization vulnerability within the Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress, affecting all versions up to and including 7.3.2. This flaw stems from a lack of capability checks and nonce verification in several AJAX action handlers: automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields. Exploitation allows any authenticated attacker with Subscriber-level privileges or above to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions. This data is retrieved via administrator-configured integration credentials, and the successful execution of these actions can also lead to the consumption of third-party API quota. This vulnerability poses a risk of sensitive information disclosure and potential service disruption for organizations leveraging the plugin.

Attack Chain

1. An attacker gains authenticated access to a WordPress instance, typically with Subscriber-level privileges or higher.
2. The attacker identifies a target WordPress site running the vulnerable Uncanny Automator plugin (versions up to 7.3.2).
3. Using their authenticated session, the attacker sends a crafted HTTP POST request to the /wp-admin/admin-ajax.php endpoint.
4. The request includes a vulnerable action parameter, such as automator_google_contacts_fetch_labels or automator_mautic_segment_fetch, bypassing the intended authorization controls due to missing capability checks and nonce verification.
5. The Uncanny Automator plugin processes the request as if it originated from an authorized user or context.
6. The plugin utilizes the administrator-configured credentials for integrated services (Google Contacts or Mautic) to fetch data from the respective third-party APIs.
7. The plugin returns sensitive information, such as Google Contacts groups/labels or Mautic segments, tags, and contact-field definitions, to the attacker.
8. The attacker successfully enumerates sensitive organizational data and potentially consumes the third-party API quota associated with the legitimate integration.

Impact

Successful exploitation of CVE-2026-15025 leads to the unauthorized enumeration of sensitive organizational data. This includes details like Google Contacts groups and labels, as well as Mautic segments, tags, and contact-field definitions. This information can reveal aspects of an organization's structure, customer base, or internal processes. Additionally, the attacker's repeated requests can cause unintended consumption of API quotas for integrated Google Contacts and Mautic services, potentially incurring unexpected costs or leading to service rate limits and disruptions for legitimate operations. The vulnerability affects any WordPress site using the Uncanny Automator plugin with affected versions.

Recommendation

• Patch CVE-2026-15025 immediately by updating the Uncanny Automator plugin to a version beyond 7.3.2.
• Deploy the Sigma rule "Detects CVE-2026-15025 Exploitation - Uncanny Automator Missing Authorization" to your SIEM to monitor for suspicious requests targeting the vulnerable AJAX actions.
• Review web server access logs for any requests from low-privileged users to /wp-admin/admin-ajax.php containing action=automator_google_contacts_fetch_labels, action=automator_mautic_segment_fetch, action=automator_mautic_tags_fetch, or action=automator_mautic_render_contact_fields.