CVE-2025-9539
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-09

Last updated on: 2025-09-09

Assigner: Wordfence

Description
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-09
Last Modified
2025-09-09
Generated
2026-06-16
AI Q&A
2025-09-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-9539
EUVD
EUVD-2025-27224
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wordpress wordpress *
automatorwp automator *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the AutomatorWP – Automator plugin for WordPress, where a missing capability check in the function automatorwp_ajax_import_automation_from_url allows authenticated users with Subscriber-level access or higher to create arbitrary automations. These automations, when activated by an administrator, can lead to Remote Code Execution or Privilege Escalation.

Impact Analysis

The vulnerability can allow attackers with low-level access (Subscriber or above) to create malicious automations that, once activated by an administrator, could execute arbitrary code remotely or escalate their privileges, potentially compromising the entire WordPress site and its data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart