Uncanny Automator EUVD-2026-44889

Exploitation requires a specific, non-default deployment: the Forminator forms plugin must be installed and at least one Forminator form must be connected to an Uncanny Automator recipe whose trigger is configured for 'Everyone', which is precisely what permits unauthenticated attackers to submit the malicious serialized payload into the fr_token deserialization path. No authentication is needed (CVSS PR:N) and no user interaction is required (UI:N). Limiting factors that reduce real-world exposure: the vulnerability is inert on sites without the Forminator integration or without an anonymous/'Everyone' recipe, the attacker must craft a valid serialized object exercising the Action_Helpers_Email __destruct() gadget (reflected in CVSS AC:H), and impact depends on the web server user having permission to delete the targeted file (e.g. wp-config.php) - the RCE step further depends on the site being reachable in its post-deletion install state.

Signals are moderately consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) shows a network-reachable, unauthenticated flaw with full CIA impact but AC:H - the high attack complexity correctly reflects that exploitation is not universal: it depends on a specific, non-default plugin configuration (Forminator form bound to an 'Everyone' recipe) and on crafting a working serialized gadget payload. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quoted, and there is no CISA KEV entry and no SSVC decision data in the input. There is no evidence of active exploitation and no public exploit was identified at time of analysis, so this is not confirmed in-the-wild activity; however, the fact that the gadget chain is self-contained within the plugin materially lowers the bar for a competent attacker versus a typical POI bug that needs an external gadget library. Net: a real priority for sites running the vulnerable configuration (unauthenticated pre-auth RCE potential), but the AC:H configuration dependency, not raw CVSS, is the true gating factor - verify whether any Forminator-to-Automator 'Everyone' recipes exist before treating it as universally critical.

An attacker locates a WordPress site running Uncanny Automator ≤7.3.1.4 with a public Forminator form wired to an 'Everyone' recipe, then submits the form with a field containing a crafted serialized PHP object targeting the Action_Helpers_Email __destruct() gadget. When the object is rehydrated and destructed server-side, the plugin deletes wp-config.php, forcing WordPress into its fresh-install state that the attacker completes to point the site at an attacker-controlled database and gain code execution. No public exploit was identified at time of analysis, but the in-plugin gadget chain means no external POI library is required.