CVE-2026-15025: Uncanny Automator Auth Bypass Vulnerability

CVE-2026-15025 Overview

CVE-2026-15025 affects the Uncanny Automator plugin for WordPress, a workflow builder used for automation, integrations, and webhooks. Versions up to and including 7.3.2 contain a Missing Authorization flaw [CWE-862] in four AJAX actions: automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields. The corresponding handlers lack both capability checks and nonce verification. Authenticated attackers with Subscriber-level access can enumerate Google Contacts labels and Mautic segments, tags, and contact-field definitions retrieved through administrator-configured integration credentials.

Critical Impact
Subscriber-level users can exfiltrate sensitive third-party integration data and exhaust API quota assigned to Google Contacts and Mautic credentials configured by site administrators.

Affected Products

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress
All versions up to and including 7.3.2
WordPress installations with Google Contacts or Mautic integrations configured

Discovery Timeline

2026-07-28 - CVE-2026-15025 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15025

Vulnerability Analysis

The vulnerability resides in four AJAX endpoints registered by the Uncanny Automator plugin. Each endpoint is reachable via wp-admin/admin-ajax.php and processes requests without validating that the requesting user has appropriate administrative capabilities. The affected handlers are ajax_fetch_labels in google-contacts-helper.php, and segments_fetch, tags_fetch, and render_contact_fields in mautic-app-helpers.php.

WordPress registers wp_ajax_<action> hooks to authenticated users of any role, including Subscriber. Because the plugin does not enforce a capability check such as current_user_can('manage_options') or verify a nonce with check_ajax_referer(), any logged-in user can invoke these actions. The handlers then use administrator-configured OAuth tokens or API credentials to query Google Contacts and Mautic on behalf of the site.

Root Cause

The root cause is a missing authorization control in AJAX action handlers. WordPress-registered AJAX actions inherit the caller's authentication context but require the plugin to enforce its own authorization. The handlers omit current_user_can() capability checks and wp_verify_nonce() or check_ajax_referer() calls, leaving the endpoints open to any authenticated session.

Attack Vector

An attacker who registers or holds a Subscriber account submits a POST request to admin-ajax.php with an action parameter matching one of the four vulnerable actions. The plugin executes the underlying integration call and returns Google Contacts labels or Mautic segments, tags, and contact-field metadata in the response. Repeated invocations consume the third-party API quota tied to the administrator's stored credentials. See the Wordfence advisory and the plugin change set for source-level details.

// Example exploitation pattern (conceptual)
// POST /wp-admin/admin-ajax.php
// Cookie: wordpress_logged_in_<hash>=<subscriber_session>
// action=automator_mautic_segment_fetch

Detection Methods for CVE-2026-15025

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php from Subscriber-level accounts containing action=automator_google_contacts_fetch_labels, action=automator_mautic_segment_fetch, action=automator_mautic_tags_fetch, or action=automator_mautic_render_contact_fields.
Unexpected spikes in outbound API calls from the WordPress host to people.googleapis.com or configured Mautic endpoints.
Google Contacts or Mautic API rate-limit or quota-exhaustion errors logged by the plugin.

Detection Strategies

Correlate WordPress access logs with user role data to flag AJAX requests made by non-administrative roles targeting Uncanny Automator actions.
Alert on any low-privilege session invoking admin-ajax.php actions prefixed with automator_ that lack a valid _wpnonce parameter.
Baseline normal Google Contacts and Mautic API call volumes and alert on deviations tied to plugin activity.

Monitoring Recommendations

Enable WordPress audit logging to capture AJAX action names, requesting user IDs, and response codes.
Forward web server access logs and application logs to a centralized analytics platform for cross-source correlation and long-term retention.
Monitor new user registrations for a burst of Subscriber accounts followed by AJAX enumeration activity.

How to Mitigate CVE-2026-15025

Immediate Actions Required

Update the Uncanny Automator plugin to a version later than 7.3.2 that includes the fix committed in change set 3607785.
If patching is not immediately possible, disable the plugin or the Google Contacts and Mautic integrations until the update is applied.
Rotate any Google Contacts OAuth tokens and Mautic API credentials configured in the plugin if abuse is suspected.

Patch Information

The vendor addressed the missing authorization by adding capability checks and nonce verification in the affected handlers. Review the Uncanny Automator plugin change set and the source files for Google Contacts Helper and Mautic App Helper for the specific handler locations.

Workarounds

Restrict WordPress user registration to trusted users and disable open Subscriber sign-up on public sites.
Deploy a web application firewall rule that blocks unauthenticated or low-privilege POST requests to admin-ajax.php containing the four affected action values.
Temporarily remove stored Google Contacts and Mautic credentials from the plugin configuration until an update is deployed.

bash

# Example WAF rule (ModSecurity syntax) blocking Subscriber-level abuse
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1500025,msg:'CVE-2026-15025 Uncanny Automator missing auth'"
  SecRule ARGS:action "@rx ^(automator_google_contacts_fetch_labels|automator_mautic_segment_fetch|automator_mautic_tags_fetch|automator_mautic_render_contact_fields)$"