CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

🗓️ 16 Jul 2026 07:51:04Reported by WordfenceType

Unauthenticated PHP object injection via fr_token allows arbitrary file deletion in Uncanny Automator ≤7.3.1.4.

Reporter	Title	Published	Views	Family All 4
cve	CVE-2026-15008	16 Jul 202607:51	–	cve
euvd	EUVD-2026-44889	16 Jul 202609:32	–	euvd
nvd	CVE-2026-15008	16 Jul 202609:16	–	nvd
ptsecurity	PT-2026-60435	16 Jul 202600:00	–	ptsecurity

[
  {
    "vendor": "uncannyowl",
    "product": "Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.3.1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/integrations/forminator/triggers/anon-fr-submitform.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/integrations/forminator/tokens/fr-tokens.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/services/email/attachment/handler.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/lib/utilities/db/class-automator-db-handler-triggers.php
plugins	www.plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.3.1.4/src/core/lib/recipe-parts/actions/trait-action-helpers-email.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9f2774e8-8b55-4c25-93c3-e0806208b1f3
plugins	www.plugins.trac.wordpress.org/changeset

16 Jul 2026 07:51Current

CVSS 3.18.1

CWE-502