Description

Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T22:17:20.540Z",
  "pubdate": "2026-08-24T22:17:20.540Z",
  "executiveSummary": "A broken access control vulnerability has been identified in the AutomatorWP plugin, affecting all versions up to and including 5.8.3. This security flaw introduces significant risk by allowing unauthorized users with subscriber-level privileges to interact with sensitive endpoints or execute privileged functions improperly restricted by the application logic.\nThe vulnerability exposes the affected WordPress installations to unauthorized state changes or data manipulation depending on the exposed component. The risk implication centers on privilege escalation vectors and unauthorized operational control within the context of the automation workflow engine. Exploitation requires authenticated access at the subscriber privilege tier, which significantly lowers the barrier for internal attackers or compromised low-privilege accounts to perform actions intended solely for higher-privileged administrative users.\nThe root cause stems from improper authorization checks within the plugin's request handling mechanisms, failing to adequately validate whether the requesting user context possesses the necessary administrative or operational capabilities before processing sensitive requests.",
  "technicalDetails": "The vulnerability resides in the access control enforcement mechanisms of the AutomatorWP plugin for versions <= 5.8.3. Specifically, the application fails to perform rigorous capability or role verification checks when handling specific HTTP requests or AJAX actions, allowing authenticated users assigned to the subscriber role to invoke backend functionality restricted by design.\nFrom a privilege and authentication perspective, the attack vector requires the adversary to possess a valid subscriber-level account on the target WordPress instance. Network exposure is standard HTTP/HTTPS access to the WordPress site's frontend or admin-ajax.php / REST API endpoints where the vulnerable routines are registered. Because the request handling logic relies on flawed authorization validations, the application treats incoming requests from low-privilege sessions as legitimate operations without verifying if the actor holds the required administrative capabilities.\nThe step-by-step attack flow initiates with the authenticated subscriber identifying the target endpoint or functional action exposed by the AutomatorWP plugin. The attacker crafts a malicious HTTP request targeting the improperly secured function, substituting or including parameters associated with administrative tasks or automated workflow manipulation. Upon receipt, the vulnerable component processes the payload without confirming the user's privilege level. The lack of proper nonce verification or strict capability checks (such as current_user_can) allows the execution flow to proceed.\nPost-exploitation impact depends on the specific AutomatorWP functions exposed by the missing access controls, potentially resulting in unauthorized automation creation, modification of site workflows, or execution of arbitrary plugin routines that lead to broader system compromise or data exposure."
}