Missing Authorization Vulnerability in Uncanny Automator Plugin for WordPress

CVE-2026-15025

What is CVE-2026-15025?

The Uncanny Automator plugin for WordPress suffers from a Missing Authorization vulnerability in versions up to and including 7.3.2. This flaw is found in the AJAX actions related to Google Contacts and Mautic integrations, specifically within the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields calls. Due to inadequate capability checks and nonce verification, authenticated attackers with at least Subscriber permissions can exploit this vulnerability. Such exploitation enables them to enumerate sensitive information, including Google Contacts groups and Mautic tags, potentially compromising API credentials and consuming third-party API quotas.

References