CVE-2026-76074
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve the site's Campaign Monitor mailing list catalog, including list IDs and names, which should be restricted to managers.
Risk Assessment
Exposure of mailing lists may compromise subscriber privacy and allow attackers to use this information for further attacks.
Recommendation
Update the plugin to the latest version that includes a security fix.
Other vulnerabilities in AutomatorWP
See all- CVE-2026-78266Medium
AutomatorWP versions up to 5.8.3 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
- CVE-2026-76057Medium
The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve all ConvertKit form data configured by the site's manager, exposing integration details intended to be restricted to managers.
- CVE-2026-42775High
Versions of AutomatorWP up to 5.7.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-42650High
Versions of AutomatorWP up to 5.6.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-40785High
AutomatorWP versions up to 5.6.7 have a vulnerability in subscriber authentication, which may lead to unauthorized access.
Original NVD description (English source)
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site's configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin's manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.