CVE-2026-2269 Details
Description
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Uncanny Automator WordPress plugin, specifically in versions through 7.0.0.3. This vulnerability allows authenticated attackers with Administrator-level access to make web requests to arbitrary locations from the web application. The exploitation of this vulnerability could be used to query and modify information from internal services. Additionally, the plugin inadvertently stores the contents of the remote files on the server, which could be leveraged to upload arbitrary files. Such uploaded files might be executed remotely, potentially leading to unauthorized code execution on the server.
Users are advised to update the Uncanny Automator WordPress plugin to version 7.1.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 3, 2026CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/changeset/3471238/ | [email protected] | Source CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Uncanny Automator | <= 7.0.0.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | New CVE Received | [email protected] |