CVE-2026-126173

The AutomatorWP Pro plugin for WordPress, specifically the webhook addon , is vulnerable to an authorization bypass in versions up to and including 1.4.4 . The root cause is the plugin's failure to properly verify user authorization when performing actions. This allows unauthenticated attackers t...

EUVD-2026-125849

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

CVE-2026-126173 AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

CVE-2026-126173: AutomatorWP AutomatorWP Webhooks: The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to,…

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

PT-2026-147363

Name of the Vulnerable Software and Affected Versions AutomatorWP Pro versions prior to 1.4.5 Description An authorization bypass exists in the webhook addon of the AutomatorWP Pro plugin for WordPress. The issue occurs because the plugin fails to properly verify if a user is authorized to perfor...

WordPress AutomatorWP Pro Webhooks addon plugin <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field vulnerability

Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin AutomatorWP Pro Webhooks versions = 1.4.4...

CVE-2026-121472

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

EUVD-2026-123184

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

CVE-2026-121472 AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

WordPress AutomatorWP plugin < 6.0.8 - Zoom/AWeber Integration Connection Hijack vulnerability

Zoom/AWeber Integration Connection Hijack vulnerability discovered by kta1kri in WordPress Plugin AutomatorWP versions 6.0.8...

CVE-2026-121472

The AutomatorWP WordPress plugin, in versions prior to 6.0.8 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a failure to bind requests completing Zoom and AWeber integration connections to the specific administrator who initiated them. An attacker can exploit thi...

CVE-2026-121472: Unknown AutomatorWP: The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration…

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

PT-2026-145020

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a...

CVE-2026-104768

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the createuser function within the anonymous-use...

CVE-2026-104768

The AutomatorWP WordPress plugin (versions

CVE-2026-104768 AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the createuser function within the anonymous-use...

EUVD-2026-119148

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the createuser function within the anonymous-use...

WordPress AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option vulnerability

Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option vulnerability discovered by John Ryan Albon in WordPress Plugin AutomatorWP versions = 6.0.4...

WordPress AutomatorWP plugin < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack vulnerability

Unauthenticated Zoom/AWeber Integration Connection Hijack vulnerability discovered by kta1kri in WordPress Plugin AutomatorWP versions 6.0.7...

CVE-2026-118239

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those servic...