Is CVE-2026-15025 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15025 being exploited in the wild.

How severe is CVE-2026-15025?

High severity, with a CVSS score of 7.5, published 28 July 2026.

Which products and versions are affected?

Uncanny Owl Uncanny Automator up to, and including, 7.3.2.

Is there a fix for CVE-2026-15025?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15025 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15025?

Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15025: Uncanny Automator WordPress plugin missing authorization in AJAX actions

CVE-2026-15025 · Severity: high · CVSS 7.5 · Published 2026-07-28

Uncanny Automator is a WordPress plugin used to connect different apps and automate workflows. A security flaw allows logged-in users with basic permissions to access sensitive information from connected Google Contacts and Mautic accounts. This could lead to the exposure of private contact labels, tags, and marketing segments, as well as the depletion of third-party API usage limits.

Technologies: Uncanny Owl Uncanny Automator. Vendors: Uncanny Owl.

Quick answers

Is CVE-2026-15025 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15025 being exploited in the wild.
How severe is CVE-2026-15025?: High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?: Uncanny Owl Uncanny Automator up to, and including, 7.3.2.
Is there a fix for CVE-2026-15025?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15025 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15025?: Check whether you run Uncanny Owl Uncanny Automator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Uncanny Automator plugin for WordPress is vulnerable to Missing Authorization in versions up to 7.3.2. The vulnerability exists within several AJAX actions, including automator_google_contacts_fetch_labels and automator_mautic_segment_fetch, because the corresponding handlers lack capability checks and nonce verification. An authenticated attacker with Subscriber-level access or higher can exploit this to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions. Additionally, an attacker can trigger these actions to consume the site's third-party API quotas. The issue is addressed in versions following 7.3.2.

Affected products

Uncanny Owl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder up to, and including, 7.3.2

Timeline

2026-07-28: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.