PT-2026-22712 · WordPress · The Uncanny Automator – Easy Automation

Lukasz Sobanski · Publicado 2026-03-03 · Atualizado 2026-03-04 · CVE-2026-2269

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin versions prior to 7.0.0.4

Description The plugin is susceptible to Server-Side Request Forgery (SSRF). This allows authenticated attackers with Administrator-level access or higher to make web requests to arbitrary locations from the web application. This can be used to query and modify information from internal services. The plugin also stores the contents of remote files on the server, potentially enabling the upload of arbitrary files and remote code execution. The vulnerable function is download url().

Recommendations Update The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin to version 7.0.0.4 or later.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-2269

Produtos afetados

The Uncanny Automator – Easy Automation

Referências · 8

• https://twitter.com/fernandokarl/status/2028987712410189955 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3471238 · Nota
• https://twitter.com/CVEnew/status/2028683868392583207 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2269 · Nota de Segurança
• https://t.me/CVEtracker/46179 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2028684523945259024 · Publicação no Twitter
• https://t.me/cveNotify/153881 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve · Nota