Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

WordPress Uncanny Automator plugin <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Integration Metadata Disclosure vulnerability discovered by thevietronin in WordPress Plugin Uncanny Automator versions = 7.3.2...

CVE-2026-15025

The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...

CVE-2026-15025 Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...

CVE-2026-15025 Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...

CVE-2026-65462

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65462

CVE-2026-65462 affects WordPress plugin Uncanny Automator up to version 7.3.2. The issue is an SQL Injection triggered via administrator context. The CVSS data indicates high confidentiality impact and a local/private exposure path with network scope and no user interaction required, but no expli...

EUVD-2026-48074

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65462 WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65462 WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65462: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

PT-2026-63884

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Uncanny Automator versions = 7.3.2...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

EUVD-2026-44889

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-15008

The CVE concerns The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. All versions up to and including 7.3.1.4 are affected by an arbitrary file deletion vulnerability caused by insufficient file path validation in the fr_token function, enabling...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-15008: Deserialization of Untrusted Data

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-12375

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator sessio...

CVE-2026-12375

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator sessio...