CVE-2026-15025

Name of the Vulnerable Software and Affected Versions Uncanny Automator versions prior to 7.3.3

Description The Uncanny Automator plugin for WordPress contains a missing authorization flaw. Authenticated users with Subscriber-level access or higher can exploit this by sending requests to the automator google contacts fetch labels, automator mautic segment fetch, automator mautic tags fetch, and automator mautic render contact fields AJAX actions. The issue stems from a lack of capability checks and missing nonce verification (a security token used to prevent cross-site request forgery) in the ajax fetch labels(), segments fetch(), tags fetch(), and render contact fields() handlers. This allows attackers to enumerate sensitive Google Contacts groups and labels, as well as Mautic segments, tags, and contact-field definitions, using credentials configured by an administrator. Additionally, this can lead to the consumption of third-party API quotas.

Recommendations Update the plugin to a version newer than 7.3.2.