CVE-2026-76057 in AutomatorWP Plugin
Summary
by MITRE • 08/22/2026
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all ConvertKit form data configured by the site's manager account, exposing integration details intended to be restricted to plugin managers. The required nonce is localized on every admin page load, making it accessible to any authenticated user who can reach /wp-admin.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The AutomatorWP plugin for WordPress serves as a no-code automation tool that allows users to create custom integrations and webhooks between various services. A critical security flaw has been identified in versions up to 5.8.4, specifically involving an authorization bypass vulnerability. This issue stems from the application's failure to properly verify whether a user possesses the necessary privileges to execute specific actions within the plugin's administrative interface. The core of the problem lies in how access control is enforced for sensitive operations, particularly those related to third-party service integrations such as ConvertKit.
The technical flaw allows authenticated attackers with subscriber-level access and above to bypass intended restrictions. In a typical WordPress environment, different user roles have distinct capabilities, with higher privileges reserved for administrators or specific plugin managers who handle integration configurations. However, due to the improper verification of authorization, lower-privileged users can interact with endpoints that should be restricted. The vulnerability is exacerbated by the fact that the required nonce, which is typically used to prevent cross-site request forgery and validate requests, is localized on every admin page load. This means any authenticated user who can access the WordPress administration area at /wp-admin automatically gains visibility of these nonces, effectively neutralizing this layer of security protection against unauthorized actions.
The operational impact of this vulnerability is significant for organizations relying on AutomatorWP to manage sensitive data integrations. Attackers with even minimal subscriber-level access can retrieve all ConvertKit form data configured by the site's manager account. This exposure includes integration details that are intended to be confidential and restricted to authorized personnel only. The leakage of such information could lead to further security compromises, including unauthorized manipulation of marketing campaigns or extraction of user data collected through those forms. It represents a clear violation of the principle of least privilege, where users gain access to resources beyond their designated role requirements.
From an industry standards perspective, this vulnerability aligns with CWE-285, which describes Improper Authorization, as well as CWE-352 regarding Cross-Site Request Forgery (CSRF), given the misuse of localized nonces that are accessible to unauthorized actors. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Privilege Escalation and potentially Data Exfiltration from Cloud Accounts or Application Interfaces. The ability for lower-privileged users to access high-value administrative functions without proper checks is a classic example of broken access control vulnerabilities that frequently appear in web application security assessments.
To mitigate this risk, site administrators should immediately update the AutomatorWP plugin to version 5.8.5 or later, where these authorization checks have been corrected. Until an update is applied, it is advisable to restrict administrative access strictly to trusted users with high-level privileges and avoid granting subscriber or higher roles unless absolutely necessary for legitimate operational needs. Additionally, implementing strict role-based access control policies within WordPress can help limit the blast radius of such vulnerabilities by ensuring that only specific user groups have permission to interact with sensitive plugin features. Regular security audits and monitoring of administrative activity logs are also recommended to detect any unauthorized attempts to exploit this flaw in real-time.