CVE-2026-2269

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2269", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-09T23:43:27.276Z", "datePublished": "2026-03-03T01:21:50.531Z", "dateUpdated": "2026-04-08T17:03:35.474Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:35.474Z"}, "affected": [{"vendor": "uncannyowl", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.0.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3471238/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lukasz Sobanski"}], "timeline": [{"time": "2026-01-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-02T12:35:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T16:12:03.350285Z", "id": "CVE-2026-2269", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:12:31.393Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T16:12:03.350285Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:12:15.196Z"}}], "cna": {"title": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Lukasz Sobanski"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "uncannyowl", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.0.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-02T12:35:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3471238/"}], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:35.474Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2269", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:35.474Z", "dateReserved": "2026-02-09T23:43:27.276Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-03T01:21:50.531Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "vendor": "uncannyowl", "versions": [{"lessThanOrEqual": "7.0.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin Uncanny Automator \u2013 Easy Automation, Integration, Webhooks &amp; Workflow Builder Plugin para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 7.0.0.3, inclusive, a trav\u00e9s de la funci\u00f3n download_url(). Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos. Adem\u00e1s, el plugin almacena el contenido de los archivos remotos en el servidor, lo que puede aprovecharse para subir archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda hacer posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2026-2269", "lastModified": "2026-06-17T10:30:40.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2269", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T16:12:03.350285Z", "version": "2.0.3"}}]}, "published": "2026-03-03T02:16:10.510", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3471238/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.0.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "source": "cna", "vendor": "uncannyowl"}, "product": "uncanny_automator_\u2013_easy_automation,_integration,_webhooks_&_workflow_builder_plugin", "vendor": "uncannyowl"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:59:15.719037+00:00", "value": {"mitigation_remediation": ["Upgrade the Uncanny Automator plugin to version\u00a07.0.0.4 or later, which removes the vulnerable download_url() functionality.", "If an upgrade is not immediately possible, block outgoing HTTP/HTTPS requests from the WordPress process to internal networks to prevent the SSRF from reaching internal services.", "As a temporary measure, disable the download_url() feature by removing the relevant plugin menu or endpoint, or delete the plugin entirely until the fix is applied."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Uncanny Automator plugin up to and including version\u00a07.0.0.3 are affected. The vulnerability is present in all releases prior to\u00a07.0.0.4. Administrator\u2011level users (or higher) on such sites can exploit it.", "description_and_impact": "The Uncanny Automator plugin is vulnerable to a server\u2011side request forgery that lets authenticated administrators use the download_url() function to fetch arbitrary URLs. Because the content of those URLs is stored on the web server, an attacker can upload a malicious file that could be executed as code, giving full control over the site. This flaw is identified as CWE\u2011434 (Unrestricted Upload of File with Dangerous Type).", "risk_and_exploitability": "The CVSS score of 7.2 classifies this as high impact. The EPSS score is less than 1\u202f%, indicating low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the flaw requires only authenticated administrator access\u2014commonly available in many WordPress installations\u2014the threat remains real. The attack path involves an administrator logging into the WordPress admin area, invoking the download_url() feature, and supplying a crafted URL that points to a malicious file. The server then retrieves and stores this file on the file system, where it can be executed if the attacker can trigger it, such as by accessing the file via a public URL or by uploading through the plugin\u2019s UI."}}}}, "created": "2026-03-04T14:54:36.693931+00:00", "updated": "2026-04-15T18:00:15.507562+00:00", "vendors": ["uncannyowl", "uncannyowl$PRODUCT$uncanny_automator_\u2013_easy_automation,_integration,_webhooks_&_workflow_builder_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}