The vulnerability resides in the Uncanny Automator WordPress plugin’s AJAX handlers for Google Contacts and Mautic integrations, where missing capability checks and nonce verification allow any authenticated user with Subscriber‑level access or higher to query sensitive integration data. This results in disclosure of group labels, segments, tags, and contact‑field definitions that belong to credentials set by administrators, and allows the attacker to consume third‑party API quota. The weakness corresponds to CWE‑862, Missing Authorization.

Affected vendor is Uncanny Owl, specifically the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin. Versions up to and including 7.3.2 contain the flaw; later releases are presumed to include fixes.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Attackers must first authenticate to the WordPress site and possess at least Subscriber role privileges; there is no remote unauthenticated attack vector. Once logged in, they can invoke the affected AJAX endpoints to harvest integration metadata, potentially leading to credential leakage and API abuse.