CVE-2026-126173

The AutomatorWP Pro plugin for WordPress, specifically the webhook addon , is vulnerable to an authorization bypass in versions up to and including 1.4.4 . The root cause is the plugin's failure to properly verify user authorization when performing actions. This allows unauthenticated attackers t...

EUVD-2026-125849

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

CVE-2026-126173 AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

CVE-2026-126173: AutomatorWP AutomatorWP Webhooks: The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to,…

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset...

PT-2026-147363

Name of the Vulnerable Software and Affected Versions AutomatorWP Pro versions prior to 1.4.5 Description An authorization bypass exists in the webhook addon of the AutomatorWP Pro plugin for WordPress. The issue occurs because the plugin fails to properly verify if a user is authorized to perfor...

WordPress AutomatorWP Pro Webhooks addon plugin <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field vulnerability

Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin AutomatorWP Pro Webhooks versions = 1.4.4...