CVE-2026-15025 describes a missing authorization vulnerability (CWE-862) in the Uncanny Automator plugin for WordPress, affecting versions up to and including 7.3.2. The issue is due to absent capability checks and nonce verification in AJAX handlers related to Google Contacts and Mautic integrations (automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, automator_mautic_render_contact_fields). Authenticated users with minimal privileges (Subscriber-level and above) can exploit this to enumerate sensitive integration data configured by administrators and potentially consume third-party API quotas. No official patch or remediation level has been provided as of the published date.

The vulnerability allows authenticated low-privilege users to access sensitive data from Google Contacts and Mautic integrations without proper authorization. This can lead to unauthorized enumeration of contact groups, segments, tags, and contact-field definitions. Additionally, attackers may consume third-party API quotas, potentially impacting service availability or incurring costs. There is no indication of direct data modification or denial of service from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and monitor for suspicious activity related to the affected AJAX actions. Applying the principle of least privilege and disabling or limiting the affected integrations may reduce exposure.