HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-15025 — The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builde...

·Source: NIST NVD

Updated:

Executive Summary

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce v

Analysis

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota. CVSS Score: 7.5. Published: 2026-07-28T12:16:35.490.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15025
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Rothera implements Eventus platform for trade surveillance of event contract exchange

Eventus, a leading provider of comprehensive, at-scale trade surveillance and financial risk solutions, and Rothera, the U.S.-based CFTC regulated event contract market, today announced that Rothera has deployed and implemented Eventus’ Validus platform for trade surveillance of its fast-growing markets.

Finextra
MEDIUMVulnerabilityNEW

Singapore's MAS and ABS set up taskforce to boost cyber resiliance against AI-driven threats

The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) today announced the establishment of the AI-Driven Cyber and Technology Risk Taskforce (ACT), an industry-wide initiative to strengthen collective cyber and technology resilience in response to the emerging risks posed by frontier artificial intelligence (AI) models.

Finextra
MEDIUMVulnerabilityNEW

Goldwise taps Integral for 24/7 institutional precious metals trading

Goldwise, the UK-based precious metals fintech, has partnered with Integral, a leading currency technology provider, to launch 24/7 institutional trading for physical gold, silver, platinum, and palladium.

Finextra