CVE-2026-15008

🗓️ 16 Jul 2026 07:51:04Reported by WordfenceType

Unauthenticated PHP object injection leads to arbitrary file deletion in Uncanny Automator up to 7.3.1.4 via Forminator.

Reporter	Title	Published	Views	Family All 5
attackerkb	CVE-2026-15008	16 Jul 202607:51	–	attackerkb
cvelist	CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token	16 Jul 202607:51	–	cvelist
euvd	EUVD-2026-44889	16 Jul 202607:51	–	euvd
nvd	CVE-2026-15008	16 Jul 202609:16	–	nvd
ptsecurity	PT-2026-60435	16 Jul 202600:00	–	ptsecurity

Vulners

Node

uncannyowl uncanny_automator_easy_automation,_integration,_webhooks_&_workflow_builder_pluginRange≤7.3.1.4wordpress

[
  {
    "vendor": "uncannyowl",
    "product": "Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.3.1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/integrations/forminator/triggers/anon-fr-submitform.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/integrations/forminator/tokens/fr-tokens.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/services/email/attachment/handler.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/lib/utilities/db/class-automator-db-handler-triggers.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/lib/recipe-parts/actions/trait-action-helpers-email.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9f2774e8-8b55-4c25-93c3-e0806208b1f3
plugins	www.plugins.trac.wordpress.org/changeset

16 Jul 2026 09:16Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

CWE-502