CVE-2026-15008 is a high severity vulnerability (CVSS 8.1) in the Uncanny Automator WordPress plugin (up to and including 7.3.1.4) that allows unauthenticated attackers to perform arbitrary file deletion via insufficient validation of file paths in the fr_token function. The attack vector requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone', permitting unauthenticated form submissions to supply a malicious serialized payload. The plugin contains a gadget chain in the Action_Helpers_Email __destruct() method enabling deserialization of untrusted data without external gadget libraries. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin, potentially leading to remote code execution if critical files like wp-config.php are removed. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable the use of Forminator forms connected to Uncanny Automator recipes configured for 'Everyone' to prevent unauthenticated submissions. Monitor for updates from the vendor and apply official patches once released.