What is the CVSS score of CVE-2026-2269?

CVE-2026-2269 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WordPress are affected by CVE-2026-2269?

Organizations using the Uncanny Automator WordPress plugin (versions up to 7.0.0.3) face a Server-Side Request Forgery vulnerability that could allow attackers to manipulate internal network requests…

How to fix or mitigate CVE-2026-2269?

Within 24 hours: Inventory all WordPress instances running Uncanny Automator and document affected versions; disable the plugin if not mission-critical or isolate affected systems from sensitive internal networks. Within 7 days: Implement WAF rules to block suspicious requests to the download_url() function; apply network segmentation to prevent compromised WordPress instances from accessing internal systems. Within 30 days: Monitor vendor releases for a security patch; evaluate alternative automation plugins as a long-term replacement strategy; conduct a risk assessment of any automation workflows currently using the affected plugin.

WordPress CVE-2026-2269

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-03 security@wordfence.com

WordPress RCE SSRF File Upload

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 02:16 nvd

HIGH 7.2

DescriptionCVE.org

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Server-Side Request Forgery in the Uncanny Automator WordPress plugin up to version 7.0.0.3 allows authenticated administrators to make arbitrary web requests from the affected server and store remote file contents locally, potentially enabling remote code execution. The vulnerability requires administrator-level privileges and has no available patch. Attackers can exploit this to interact with internal services and upload arbitrary files to the web server.

Technical ContextAI

Classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the

Affected ProductsAI

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request For

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.