CVE-2026-15025 json
Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
published 2026-07-28 3 mo ago modified 2026-07-28 3 mo ago also EUVD-2026-49758
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/1bfa1538-7722-458d-a6a5-adde03e21e1a?source=cve
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/google-contacts/helpers/google-contacts-helper.php#L1
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/google-contacts/google-contacts-integration.php#L70
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/mautic/helpers/mautic-app-helpers.php#L199
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/mautic/helpers/mautic-app-helpers.php#L250
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/mautic/helpers/mautic-app-helpers.php#L302
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.3.1.4/src/integrations/mautic/mautic-integration.php#L60
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/google-contacts/helpers/google-contacts-helper.php#L113
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/google-contacts/google-contacts-integration.php#L70
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L199
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L250
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L302
- plugins.trac.wordpress.org /browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/mautic-integration.php#L60
- plugins.trac.wordpress.org /changeset?reponame=&old=3607785%40uncanny-automator&new=3607785%40uncanny-automator
Sources
- CVE List CVE-2026-15025
- NVD CVE-2026-15025
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.