Description

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-11-06T06:16:41.140Z",
  "pubdate": "2026-11-06T06:16:41.140Z",
  "executiveSummary": "The AutomatorWP WordPress plugin, in versions prior to 6.0.7, contains a critical security vulnerability involving improper authorization for third-party integration connections. The flaw allows unauthenticated remote attackers to perform unauthorized administrative actions by overwriting existing OAuth integration credentials for Zoom and AWeber services.\nThe vulnerability stems from the plugin's failure to validate the identity or authorization level of users triggering the integration connection flow. Consequently, an attacker can substitute the legitimate site owner's API credentials with their own. This results in the exfiltration or redirection of sensitive site data and automated workflows to an attacker-controlled external account.\nThe impact is significant, as it leads to potential data breaches and the compromise of automated business logic reliant on these integrations. Exploitation is contingent upon the target site having an active integration and the attacker possessing knowledge of the specific OAuth client identifier used by the site. This vulnerability is classified as a broken access control issue, necessitating immediate remediation to maintain data integrity and service confidentiality.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper nonce verification or session-based authentication checks within the integration management handlers for the Zoom and AWeber components of the AutomatorWP plugin. Specifically, the functionality responsible for finalizing the OAuth handshake process fails to verify if the request originator possesses the necessary administrative capabilities to modify plugin settings or integration configurations.\nThe exploitation flow begins when an attacker identifies the target WordPress installation running an affected version of AutomatorWP. Because the vulnerable endpoint does not enforce authentication, an unauthenticated attacker can initiate or intercept the OAuth callback process. By crafting a malicious HTTP request that mimics the expected callback structure, the attacker forces the plugin to overwrite stored API tokens and client secrets in the database.\nCrucially, the attack requires the attacker to be aware of the site's OAuth client identifier. Once the application processes the attacker-provided credentials, the plugin updates the database records, effectively re-binding the integration to the attacker's Zoom or AWeber account. Consequently, any automated tasks, logs, or user data that were configured to be pushed to the legitimate service are instead transmitted to the attacker's infrastructure.\nThis behavior facilitates a man-in-the-middle scenario for automated workflows, where the attacker gains transparent access to the data stream intended for the legitimate integration. As the plugin updates its internal state to reflect these new credentials, the change persists until an administrator manually intervenes or replaces the keys. Since the vulnerable component fails to check for user permissions, it remains susceptible to any actor capable of reaching the plugin's integration endpoint via the network. This represents a significant security failure where the integrity of automated data pipelines is fully compromised by the ability of a remote, unauthenticated party to manipulate sensitive configuration variables without restriction."
}