CVE-2026-15008 Overview
CVE-2026-15008 is an arbitrary file deletion vulnerability in the Uncanny Automator WordPress plugin, affecting all versions up to and including 7.3.1.4. The flaw exists in the fr_token function, which performs insufficient file path validation and processes attacker-controlled serialized data. Unauthenticated attackers can delete arbitrary files on the server, including wp-config.php, which triggers WordPress setup mode and enables remote code execution. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Unauthenticated attackers can delete wp-config.php and other server files, leading to full site compromise and remote code execution.
Affected Products
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress
- All plugin versions through 7.3.1.4
- WordPress sites using a Forminator form linked to an Uncanny Automator recipe configured for "Everyone"
Discovery Timeline
- 2026-07-16 - CVE-2026-15008 published to the National Vulnerability Database
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-15008
Vulnerability Analysis
The vulnerability originates from unsafe PHP object deserialization in the Forminator integration path of the Uncanny Automator plugin. When a Forminator form is bound to an Uncanny Automator recipe with the "Everyone" access setting, unauthenticated visitors can submit form data that reaches the fr_token function in src/integrations/forminator/tokens/fr-tokens.php. That function processes attacker-supplied input without adequate validation, enabling PHP object injection.
The plugin ships an internal gadget chain through the Action_Helpers_Email::__destruct() method. When the injected object is destroyed at the end of the request, the destructor invokes file operations that ultimately unlink attacker-controlled paths. No external gadget library is required because the vulnerable class ships with the plugin itself.
Deleting wp-config.php causes WordPress to enter its installation flow on the next request. An attacker can then reinstall the site, pointing it to a database under their control, and execute arbitrary PHP through the plugin editor or theme upload paths.
Root Cause
The root cause is the combination of unsafe deserialization of user-supplied input in fr_token and missing path validation in the email attachment handler at src/core/services/email/attachment/handler.php. The destructor in trait-action-helpers-email.php treats attachment paths as trusted and calls file deletion routines without confirming the file resides in an allowlisted directory.
Attack Vector
The attack requires network access to a public Forminator form connected to an Uncanny Automator recipe scoped to "Everyone". The attacker submits the form with a serialized PHP payload embedded in the tokenized field data. The submission is handled by the anonymous form-submit trigger at src/integrations/forminator/triggers/anon-fr-submitform.php, which invokes fr_token and instantiates the malicious object. The __destruct method then runs at request shutdown and deletes the target file. No authentication, credentials, or user interaction are required.
See the WordPress Form Tokens Code and the WordPress Action Helper Code for the vulnerable code paths.
Detection Methods for CVE-2026-15008
Indicators of Compromise
- Forminator form submissions containing PHP serialized object markers such as O: or a: in token fields
- Unexpected absence of wp-config.php or presence of the WordPress installation screen on a previously configured site
- Web server logs showing POST requests to Forminator submission endpoints followed by 500 errors or missing-file errors from PHP
- New administrator accounts created immediately after a WordPress reinstall event
Detection Strategies
- Inspect access logs for POST requests to admin-ajax.php or Forminator form endpoints where request bodies contain serialized PHP payloads targeting the Action_Helpers_Email class
- Monitor file integrity for wp-config.php, .htaccess, and core WordPress files to catch unauthorized deletions
- Alert on WordPress transitioning into installation mode outside of planned maintenance windows
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress root, wp-content/plugins, and wp-content/uploads directories
- Forward web server and PHP error logs to a centralized log platform and alert on unlink() failures or missing wp-config.php errors
- Track outbound connections from the WordPress host to unknown database servers, which can indicate a reinstallation hijack
How to Mitigate CVE-2026-15008
Immediate Actions Required
- Update the Uncanny Automator plugin to a version later than 7.3.1.4 as soon as the vendor patch is available
- Audit all Forminator forms and disable any Uncanny Automator recipe configured with the "Everyone" access setting until patched
- Verify wp-config.php integrity and rotate database credentials, AUTH_KEY, and other salts if tampering is suspected
- Review administrator accounts and remove any that were not provisioned by your team
Patch Information
The vendor addressed the issue in the WordPress Code Changeset. Additional analysis is available in the Wordfence Vulnerability Report.
Workarounds
- Restrict Uncanny Automator recipes tied to Forminator to authenticated users only, removing the "Everyone" scope
- Deactivate the Uncanny Automator plugin on hosts where a patched version cannot be installed immediately
- Deploy a web application firewall rule that blocks Forminator submissions containing serialized PHP object patterns such as O: followed by a class name
- Enforce filesystem permissions so the PHP process cannot delete wp-config.php or files outside expected upload directories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
