CVE-2026-126173
Deferred Deferred - Pending Action

Authorization Bypass in AutomatorWP Pro Webhook Addon

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: Wordfence

Description
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-14
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-126173
EUVD
EUVD-2026-125849

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AutomatorWP AutomatorWP Webhooks From 0 (inc) to 1.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AutomatorWP Pro plugin for WordPress has an authorization bypass vulnerability in versions up to 1.4.4. This flaw allows unauthenticated attackers to reset passwords of any WordPress account, including administrators, leading to full account takeover. The issue occurs when an administrator configures a specific automation in the webhook addon that pairs a Receive Webhook trigger with an Update-User action, leaving certain fields blank.

Detection Guidance

Check WordPress sites for the AutomatorWP Pro plugin versions up to 1.4.4. Inspect webhook configurations for Receive Webhook triggers paired with Update-User actions where the User ID field is blank and Password field uses the webhook password tag. Review server logs for unauthorized password reset requests or unusual automation activity.

Impact Analysis

Attackers can exploit this to reset passwords of any user account, including administrators, gaining full control of WordPress sites. This could lead to site takeover, data theft, malware installation, or disruption of services. The impact is severe due to the potential for complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update the AutomatorWP Pro plugin to the latest version beyond 1.4.4. Disable any vulnerable webhook automations, especially those with blank User ID fields and Password mappings. Implement strict access controls and monitor for unauthorized password reset attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...