Description

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site's configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin's manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-22T04:18:17.990Z",
  "pubdate": "2026-08-22T04:18:17.990Z",
  "executiveSummary": "The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to an authorization bypass vulnerability affecting all versions up to, and including, 5.8.4. This security flaw allows authenticated low-privileged users, specifically those with subscriber-level access and above, to perform unauthorized actions restricted to higher-privileged roles. The vulnerability specifically enables the unauthorized retrieval of sensitive integration data, including the site's configured Campaign Monitor mailing list catalog containing list IDs and names. The root cause stems from inadequate authorization verification checks within the plugin's action-handling logic combined with the unconditional exposure of required security nonces via wp_localize_script on every WordPress admin page. Attackers can exploit this by simply visiting an accessible admin page such as /wp-admin/profile.php to harvest the nonce and subsequently issue crafted requests to extract restricted configuration data. The risk implication involves the exposure of sensitive third-party integration identifiers, which could facilitate further reconnaissance and targeted attacks against the WordPress environment. Exploitation requires authenticated access at the subscriber level and the ability to interact with the WordPress admin interface to retrieve the leaked nonce.",
  "technicalDetails": "The vulnerability is an authorization bypass flaw located within the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress. It affects all plugin versions up to, and including, 5.8.4. The root cause of the vulnerability is the absence of robust access control checks to verify whether an executing user possesses the requisite plugin manager capability before processing specific administrative requests. Specifically, functionality designed to fetch and return the site's configured Campaign Monitor mailing list catalog—comprising sensitive list IDs and names—fails to properly validate the user's privileges against the expected authorization tier.\nCompounding this insufficient capability check is the insecure handling of security nonces. The plugin unconditionally emits the required validation nonce on every WordPress admin page via the wp_localize_script function. Because this nonce is rendered globally across the administrative interface, any authenticated user, including those with minimal privileges such as a subscriber, can effortlessly obtain the nonce simply by browsing to an accessible administrative endpoint like /wp-admin/profile.php. No elevated privileges or specialized administrative access are required to harvest this token.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with subscriber-level access navigates to /wp-admin/profile.php. Second, the attacker extracts the exposed nonce from the page source where it was injected via wp_localize_script. Third, the attacker crafts and sends an asynchronous or direct HTTP request to the vulnerable AJAX or REST endpoint responsible for handling Campaign Monitor integrations, supplying the harvested nonce. Fourth, the backend code processes the request; while it validates the presence of the nonce, it fails to verify if the requesting user holds the manager capability. Consequently, the backend executes the request and returns the sensitive Campaign Monitor mailing list catalog, exposing internal identifiers to unauthorized entities.\nThe post-exploitation impact includes the unauthorized disclosure of internal third-party service configurations. Exposure of Campaign Monitor list IDs and names provides attackers with intelligence that can be leveraged for targeted phishing campaigns, further reconnaissance, or mapping out automated workflows configured within the AutomatorWP environment."
}