CVE-2026-76074 in AutomatorWP Plugin
Summary
by MITRE • 08/22/2026
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site's configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin's manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The AutomatorWP plugin for WordPress serves as a no-code automation tool that allows users to create webhooks and custom integrations between various services. A critical security flaw has been identified in versions up to 5.8.4, specifically involving an authorization bypass vulnerability within the integration with Campaign Monitor. This vulnerability stems from insufficient verification of user privileges when performing specific actions related to retrieving mailing list data. The core issue lies in the plugin's failure to properly enforce capability checks before allowing access to sensitive configuration details, such as the catalog of configured Campaign Monitor lists including their IDs and names.
The technical mechanism behind this flaw involves the unconditional emission of nonces via the wp_localize_script function on every WordPress admin page. Nonces are typically used to prevent Cross-Site Request Forgery attacks by ensuring that requests originate from legitimate users who have accessed a specific form or action. However, in this case, because the nonce is made available globally through standard administrative pages like profile.php, any authenticated user with subscriber-level access and above can obtain it without needing elevated privileges. This effectively neutralizes the protective value of the nonce for these lower-privileged accounts when interacting with vulnerable endpoints within the plugin.
The operational impact of this vulnerability allows attackers who have obtained valid WordPress credentials at even the lowest privilege level to retrieve sensitive information about the site's email marketing configuration. Specifically, an attacker can access the complete list of Campaign Monitor mailing lists associated with the target website. This exposure includes both the unique identifiers and names of these lists, which could be leveraged for further malicious activities such as targeted phishing campaigns or social engineering attacks against subscribers listed in those catalogs. The ability to enumerate this data represents a significant breach of confidentiality within the application's security model.
From an industry standards perspective, this vulnerability aligns with CWE-285 Improper Authorization, where the software does not perform correct checks before granting access to resources. Additionally, it relates to CWE-347 Improper Verification of Cryptographic Signature if one considers the nonce as a form of cryptographic verification that was improperly validated or made accessible in an insecure manner. In terms of attack vectors, this scenario reflects aspects of ATT&CK technique T1098 Account Manipulation, particularly regarding unauthorized access through privilege escalation paths enabled by misconfigured permissions and exposed authentication tokens.
Mitigation strategies should prioritize immediate updates to the latest version of the AutomatorWP plugin where these authorization checks have been corrected. Administrators must ensure that all instances are patched to prevent exploitation. In environments where updating is not immediately feasible, restricting administrative page access to only those users who genuinely require it can reduce the attack surface by limiting exposure of nonces and other sensitive data embedded in admin pages. Furthermore, implementing strict role-based access control policies ensures that lower-privileged accounts cannot interact with functions requiring higher clearance levels, thereby closing the authorization gap exploited by this vulnerability.