CVE-2026-2269
Published: 03 March 2026
Summary
CVE-2026-2269 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2269 is a Server-Side Request Forgery (SSRF) vulnerability in the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress, affecting all versions up to and including 7.0.0.3. The flaw exists in the download_url() function, which allows the server to make unauthorized web requests to arbitrary locations. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with Administrator-level access or higher can exploit this vulnerability to initiate web requests from the affected WordPress site to arbitrary internal or external locations, enabling them to query or modify sensitive information on internal services. Additionally, the plugin stores the contents of these remote files directly on the server, which attackers can leverage to upload arbitrary files, potentially resulting in remote code execution on the compromised site.
Mitigation is addressed in a patch via WordPress plugin trac changeset 3471238. Further details on the vulnerability and remediation are available in Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9272
Vulnerability details
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers,…
more
with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing WordPress plugin directly enables T1190 exploitation; arbitrary remote file storage/upload enables T1105 for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of URL inputs to the download_url() function, directly blocking arbitrary external or internal destinations that enable the SSRF.
Restricts unauthorized information flows from the WordPress server to arbitrary or internal locations, preventing the core SSRF requests and subsequent file retrieval.
Applies boundary protections (e.g., outbound allow-lists or proxies) that limit the plugin's ability to reach internal services or store attacker-controlled files.