CVE-2026-15025
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
Schwachstellenklasse
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
Quellen
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/google-contacts/google-contacts-integration.php#L70
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/google-contacts/helpers/google-contacts-helper.php#L113
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L199
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L250
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/helpers/mautic-app-helpers.php#L302
- https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/7.2.1/src/integrations/mautic/mautic-integration.php#L60
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.