Is CVE-2026-15008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15008 being exploited in the wild.

How severe is CVE-2026-15008?

High severity, with a CVSS score of 8.1, published 16 July 2026.

Which products and versions are affected?

Uncanny Owl Uncanny Automator up to, and including, 7.3.1.4.

Is there a fix for CVE-2026-15008?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15008 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15008?

Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15008: Uncanny Automator arbitrary file deletion via insecure deserialization

CVE-2026-15008 · Severity: high · CVSS 8.1 · Published 2026-07-16

Uncanny Automator, a popular WordPress plugin used to connect different apps and automate workflows, contains a security flaw that allows unauthorized individuals to delete files from the website's server. By deleting critical system files like the site's configuration file, an attacker can take complete control of the website or cause a total service outage. This vulnerability specifically affects sites using the Forminator plugin alongside certain Uncanny Automator configurations.

Technologies: Uncanny Owl Uncanny Automator. Vendors: Uncanny Owl.

Quick answers

Is CVE-2026-15008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15008 being exploited in the wild.
How severe is CVE-2026-15008?: High severity, with a CVSS score of 8.1, published 16 July 2026.
Which products and versions are affected?: Uncanny Owl Uncanny Automator up to, and including, 7.3.1.4.
Is there a fix for CVE-2026-15008?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15008 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15008?: Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Uncanny Automator plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. This flaw, combined with an insecure deserialization vulnerability (CWE-502), allows unauthenticated attackers to supply a malicious serialized payload via a Forminator form submission. The plugin contains a built-in gadget chain in the Action_Helpers_Email __destruct() method, which can be leveraged to delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to a full site takeover or remote code execution. The attack requires a specific configuration where a Forminator form is connected to an Uncanny Automator recipe set for 'Everyone'.

Affected products

Uncanny Owl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin up to, and including, 7.3.1.4

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.