AutomatorWP Plugin up to 6.0.7 on WordPress cross-site request forgery

Summaryinfo

A vulnerability labeled as problematic has been found in AutomatorWP Plugin up to 6.0.7. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. This vulnerability is handled as CVE-2026-121472. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in AutomatorWP Plugin up to 6.0.7 and classified as problematic. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. As an impact it is known to affect integrity. CVE summarizes:

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

The advisory is shared for download at wpscan.com. This vulnerability was named CVE-2026-121472 since 11/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.0.8 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• AutomatorWP Plugin

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion