Access Control Flaw in AutomatorWP Plugin for WordPress
CVE-2026-118239
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 November 2026
Badges
What is CVE-2026-118239?
The AutomatorWP plugin for WordPress prior to version 6.0.7 contains a significant access control flaw. This vulnerability enables unauthenticated attackers to exploit the plugin’s Zoom and AWeber integration functionalities by replacing the authenticated user's stored credentials with their own. As a result, attackers can redirect sensitive data, which is intended for the legitimate services, into accounts they control. To exploit this vulnerability, the attacker must already have the integration established and possess knowledge of the site's OAuth client identifier.
Affected Version(s)
AutomatorWP 0 < 6.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.