CVE-2026-15008 is a CWE-502 deserialization of untrusted data vulnerability in the Uncanny Automator WordPress plugin (<=7.3.1.4). The vulnerability arises from insufficient validation of file paths in the fr_token function, allowing unauthenticated attackers to submit malicious serialized payloads via a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'. The plugin contains an internal gadget chain through the Action_Helpers_Email __destruct() method, enabling arbitrary file deletion on the server without external gadget libraries. Deleting critical files such as wp-config.php can lead to remote code execution. The CVSS v3.1 score is 8.1, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin by exploiting the deserialization flaw. This can lead to remote code execution if critical files like wp-config.php are deleted, compromising the entire WordPress installation and potentially the underlying server. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable any Forminator forms connected to Uncanny Automator recipes configured for 'Everyone' to prevent unauthenticated submissions. Monitor for updates from the vendor and apply patches promptly once released.