CVE-2026-104728 in AutomatorWP Plugin
Summary
by MITRE • 10/10/2026
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate all Fluent Forms records, including form IDs and titles, from the fluentform_forms database table.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin represents a significant component in WordPress ecosystems by enabling users to create complex automation workflows without coding knowledge. However, versions up through 5.8.4 contain a critical authorization bypass vulnerability that undermines the fundamental security model of role-based access control within the application. This flaw stems from insufficient verification mechanisms when processing requests related to Fluent Forms data integration. Specifically, the plugin fails to properly validate whether the authenticated user possesses the necessary privileges to execute specific actions or retrieve sensitive information associated with integrated third-party services.
The technical nature of this vulnerability allows any authenticated attacker holding subscriber-level access and above to bypass intended restrictions on data retrieval operations. By exploiting the lack of proper authorization checks, an adversary can interact directly with internal API endpoints or database queries that are supposed to be restricted to administrators or users with higher privilege levels. This misconfiguration effectively neutralizes the protective barriers designed to isolate sensitive workflow automation logic from lower-privileged user accounts, creating a direct path for unauthorized data access.
The operational impact of this vulnerability is primarily centered on information disclosure and potential reconnaissance activities against the target WordPress installation. Attackers can enumerate all Fluent Forms records stored in the fluentform_forms database table. This enumeration includes critical metadata such as form IDs and titles, which provide valuable context about the structure and purpose of forms created by other users or administrators. While this does not immediately lead to remote code execution, it facilitates further attacks by revealing internal application structures, potentially aiding in crafting more targeted exploits against specific form configurations or exposing business logic embedded within those forms.
From a classification perspective, this vulnerability aligns with CWE-285, which describes Improper Authorization, as the system fails to enforce proper access controls for authorized users. Furthermore, it relates to ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to resources. The ability to enumerate form data also touches upon aspects of information gathering that could support subsequent phases of an attack lifecycle if combined with other vulnerabilities in the WordPress environment or its plugins.
Mitigation strategies for this vulnerability involve immediate remediation through software updates and rigorous configuration management. Administrators should upgrade AutomatorWP to a version later than 5.8.4, where the authorization checks have been corrected by the developers to ensure that only users with appropriate permissions can access Fluent Forms data. In cases where updating is not immediately feasible, implementing strict role-based access controls at the WordPress level and monitoring for unusual API request patterns from low-privileged accounts can provide temporary relief. Additionally, regular security audits of plugin configurations and adherence to least privilege principles are essential practices to prevent similar authorization bypasses in future deployments.