PT-2026-22712 · WordPress · The Uncanny Automator – Easy Automation

Lukasz Sobanski · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-2269

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin versions prior to 7.0.0.4

Description The plugin is susceptible to Server-Side Request Forgery (SSRF). This allows authenticated attackers with Administrator-level access or higher to make web requests to arbitrary locations from the web application. This can be used to query and modify information from internal services. The plugin also stores the contents of remote files on the server, potentially enabling the upload of arbitrary files and remote code execution. The vulnerable function is download url().

Recommendations Update The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin to version 7.0.0.4 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-2269

Affected Products

The Uncanny Automator – Easy Automation

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2269 · Security Note
• https://twitter.com/fernandokarl/status/2028987712410189955 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3471238 · Note
• https://twitter.com/CVEnew/status/2028683868392583207 · Twitter Post
• https://t.me/CVEtracker/46179 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028684523945259024 · Twitter Post
• https://t.me/cveNotify/153881 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve · Note