Privilege Escalation in AutomatorWP Plugin for WordPress
CVE-2026-104768
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
What is CVE-2026-104768?
The AutomatorWP plugin for WordPress, specifically in the create_user() function, allows for privilege escalation due to inadequate role validation. This security flaw affects all versions up to and including 6.0.4 and permits unauthenticated users to create administrator-level accounts by exploiting dynamic trigger tags such as {comment_author}. When a site administrator approves a comment, this vulnerability can be triggered, leading to the creation of a privileged account linked to an attacker-controlled email. This critical lack of verification can grant unauthorized access to sensitive site operations without any noticeable cues in the user interface.
Affected Version(s)
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI 0 <= 6.0.4