Description

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all ConvertKit form data configured by the site's manager account, exposing integration details intended to be restricted to plugin managers. The required nonce is localized on every admin page load, making it accessible to any authenticated user who can reach /wp-admin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-22T04:18:17.367Z",
  "pubdate": "2026-08-22T04:18:17.367Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress in all versions up to, and including, 5.8.4.\nThe vulnerability arises from insufficient authorization verification checks, allowing authenticated users with subscriber-level access and above to improperly execute restricted actions.\nThe primary impact of this security flaw is the unauthorized disclosure of sensitive data, specifically enabling attackers to retrieve all ConvertKit form data configured by the site manager account.\nThis exposes sensitive third-party integration details that are explicitly intended to be restricted exclusively to administrative or plugin manager roles.\nAttackers require low-privileged authenticated access, such as a standard subscriber account, and the ability to reach /wp-admin to successfully exploit the system.\nExploitation is facilitated by the exposure of the required cryptographic nonce, which is localized and rendered accessible on every administrative page load to any authenticated user visiting the dashboard.\nThe risk implication is moderate to high regarding information disclosure, potentially exposing API keys, subscriber segments, or internal marketing parameters associated with the ConvertKit integration.",
  "technicalDetails": "The root cause of the vulnerability stems from missing or inadequate capability checks and role-based access control (RBAC) validation within the plugin's request handling logic.\nSpecifically, the affected component fails to properly verify whether the executing user possesses the administrative authorization required to perform sensitive integration-related actions.\nThe vulnerability affects all versions of the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress up to, and including, version 5.8.4.\nAuthentication and privilege requirements are minimal, necessitating only a valid user account with subscriber-level privileges or higher.\nNetwork exposure is defined by accessibility to the WordPress administration panel, specifically endpoints reachable via /wp-admin.\nThe exploitation mechanism relies heavily on the predictable exposure of the application nonce.\nIn the vulnerable versions, the necessary security nonce is localized and output directly into the source code of every administrative page load.\nConsequently, any authenticated user capable of navigating to /wp-admin can harvest this nonce.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress instance using a low-privileged subscriber account.\nSecond, the attacker browses to /wp-admin to retrieve the exposed security nonce from the page markup or localized script variables.\nThird, the attacker crafts an unauthorized HTTP request targeting the vulnerable AJAX or REST endpoint within the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin.\nFourth, the attacker supplies the harvested nonce within the request headers or parameters.\nFifth, because the backend logic lacks proper capability verification, the application processes the request, bypassing intended security boundaries.\nFinally, the server responds by disclosing all configured ConvertKit form data, exposing integration details intended exclusively for plugin managers.\nPost-exploitation impact includes the exposure of sensitive marketing infrastructure configurations, form IDs, and potentially connected API tokens, which could be leveraged for further reconnaissance or targeted attacks against connected third-party services."
}