Attack Chain

1. An attacker gains authenticated access to a WordPress instance, typically with Subscriber-level privileges or higher.
2. The attacker identifies a target WordPress site running the vulnerable Uncanny Automator plugin (versions up to 7.3.2).
3. Using their authenticated session, the attacker sends a crafted HTTP POST request to the /wp-admin/admin-ajax.php endpoint.
4. The request includes a vulnerable action parameter, such as automator_google_contacts_fetch_labels or automator_mautic_segment_fetch, bypassing the intended authorization controls due to missing capability checks and nonce verification.
5. The Uncanny Automator plugin processes the request as if it originated from an authorized user or context.
6. The plugin utilizes the administrator-configured credentials for integrated services (Google Contacts or Mautic) to fetch data from the respective third-party APIs.
7. The plugin returns sensitive information, such as Google Contacts groups/labels or Mautic segments, tags, and contact-field definitions, to the attacker.
8. The attacker successfully enumerates sensitive organizational data and potentially consumes the third-party API quota associated with the legitimate integration.

Impact

Successful exploitation of CVE-2026-15025 leads to the unauthorized enumeration of sensitive organizational data. This includes details like Google Contacts groups and labels, as well as Mautic segments, tags, and contact-field definitions. This information can reveal aspects of an organization's structure, customer base, or internal processes. Additionally, the attacker's repeated requests can cause unintended consumption of API quotas for integrated Google Contacts and Mautic services, potentially incurring unexpected costs or leading to service rate limits and disruptions for legitimate operations. The vulnerability affects any WordPress site using the Uncanny Automator plugin with affected versions.

Recommendation

• Patch CVE-2026-15025 immediately by updating the Uncanny Automator plugin to a version beyond 7.3.2.
• Deploy the Sigma rule "Detects CVE-2026-15025 Exploitation - Uncanny Automator Missing Authorization" to your SIEM to monitor for suspicious requests targeting the vulnerable AJAX actions.
• Review web server access logs for any requests from low-privileged users to /wp-admin/admin-ajax.php containing action=automator_google_contacts_fetch_labels, action=automator_mautic_segment_fetch, action=automator_mautic_tags_fetch, or action=automator_mautic_render_contact_fields.