EUVD-2026-44889
GHSA-m5q4-xwgp-qwg2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated via anonymous form (AV:N/PR:N/UI:N); AC:H because a specific non-default Forminator-'Everyone' recipe and a crafted gadget payload are required; file deletion enabling RCE gives full C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone', allowing unauthenticated form submissions to supply the malicious serialized payload; a gadget chain is present within the plugin via the Action_Helpers_Email __destruct() method, meaning no external gadget library is required.
AnalysisAI
Arbitrary file deletion in the Uncanny Automator WordPress plugin (all versions through 7.3.1.4) lets unauthenticated attackers delete any file on the server via untrusted PHP object deserialization in the fr_token function, and deleting a critical file such as wp-config.php can pivute WordPress into an installation/setup state that yields remote code execution. Exploitation is gated by a specific setup: a Forminator form must be connected to an Uncanny Automator recipe whose trigger is configured for 'Everyone', which is what exposes the deserialization sink to anonymous form submissions. A self-contained gadget chain via Action_Helpers_Email::__destruct() ships inside the plugin, so no external gadget library is needed; reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
The root cause is CWE-502 (Deserialization of Untrusted Data), a PHP Object Injection pattern. The Forminator integration's anonymous submit handler (anon-fr-submitform.php) and token layer (fr-tokens.php fr_token, line 136) accept a serialized payload from the form submission and pass it through PHP unserialize() without validating the resulting object graph or the file paths it references. Because the trigger data is persisted and later rehydrated (via the triggers DB handler), attacker-controlled objects are instantiated in the plugin's context. The 'gadget chain' abuses PHP's automatic __destruct() invocation: the Action_Helpers_Email email trait (trait-action-helpers-email.php, line 481) and the email attachment handler (handler.php, line 201) perform filesystem operations on object properties during cleanup, so a crafted object leads to unlink()/deletion of an attacker-chosen path. The affected component is uncannyowl's 'Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin' (CPE cpe:2.3:a:uncannyowl:uncanny_automator...), which depends on the separate Forminator forms plugin being installed and wired into a recipe.
RemediationAI
Upstream fix available (WordPress.org plugin changeset 3607776); released patched version not independently confirmed from the provided data - update the Uncanny Automator plugin to the latest version above 7.3.1.4 as published on WordPress.org and confirm the fixed version in the Wordfence advisory before relying on it. Until patched, the most targeted compensating control is to break the exploit precondition: reconfigure or disable any Uncanny Automator recipe whose Forminator trigger is set to 'Everyone' (anonymous), or temporarily deactivate the Forminator-to-Automator integration, which stops anonymous form submissions from reaching the deserialization sink at the cost of losing those automation workflows. As defense in depth, place a WAF rule to block serialized PHP object markers (e.g. 'O:' patterns) in Forminator submission fields, restrict filesystem permissions so the web user cannot delete wp-config.php or core files, and monitor for unexpected deletion of wp-config.php or entry into the WordPress setup/installation flow. Reference the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2774e8-8b55-4c25-93c3-e0806208b1f3?source=cve) and the fix changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3607776%40uncanny-automator&new=3607776%40uncanny-automator).
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today