Junglewise Threat Intelligence

CVE-2026-15008: Uncanny Automator arbitrary file deletion via insecure deserialization

CVE-2026-15008 · Severity: high · CVSS 8.1 · Published 2026-07-16

Technologies: Uncanny Owl Uncanny Automator. Vendors: Uncanny Owl.

Executive brief

Uncanny Automator, a popular WordPress plugin used to connect different apps and automate workflows, contains a security flaw that allows unauthorized individuals to delete files from the website's server. By deleting critical system files like the site's configuration file, an attacker can take complete control of the website or cause a total service outage. This vulnerability specifically affects sites using the Forminator plugin alongside certain Uncanny Automator configurations.

Technical details

The Uncanny Automator plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. This flaw, combined with an insecure deserialization vulnerability (CWE-502), allows unauthenticated attackers to supply a malicious serialized payload via a Forminator form submission. The plugin contains a built-in gadget chain in the Action_Helpers_Email __destruct() method, which can be leveraged to delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to a full site takeover or remote code execution. The attack requires a specific configuration where a Forminator form is connected to an Uncanny Automator recipe set for 'Everyone'.

Affected products

  • Uncanny Owl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin up to, and including, 7.3.1.4

Timeline

  • 2026-07-16: disclosed
  • 2026-07-16: advisory

References

Related threats