CVE Database /
CVE-2026-15008
CVE · High
CVE-2026-15008 — Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.4.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-15008
|
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 7.4.0 |
Deserialization of Untrusted Data |
High
8.1
|
< 7.4.0
|
7.4.0 |
2026-07-15 |
—
|
CVE-2026-15008
A critical vulnerability exists in all versions of the Uncanny Automator plugin up to and including 7.3.1.4, allowing unauthenticated attackers to delete any file on the server due to inadequate validation of file paths within the fr_token function. This flaw enables malicious actors to exploit it by submitting a specially crafted form through an Uncanny Automator recipe with open access, ultimately leading to potential remote code execution if sensitive files like wp-config.php are deleted.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings