CVE-2026-126173
Auth bypass in AutomatorWP Pro webhook addon through 1.4.4
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
The AutomatorWP Pro webhook addon does not properly check that a user is authorized to act, in all versions through 1.4.4. An unauthenticated remote attacker can reset any WordPress account password, including an administrator's, and take over the account. This works only if an administrator has paired a Receive Webhook trigger that has an 'Is the user ID' field with an Update User action whose User ID is blank and whose Password field maps to the webhook password tag.
What to do: No fixed version is stated; apply AutomatorWP's update for CVE-2026-126173.
| Product | Affected |
|---|---|
| AutomatorWP Pro webhook addon | all versions up to, and including, 1.4.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.
- Ecosystems
- WordPress
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.