Cross-Site Request Forgery Vulnerability in AutomatorWP WordPress Plugin
CVE-2026-121472
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
What is CVE-2026-121472?
The AutomatorWP WordPress plugin prior to version 6.0.8 contains a design flaw that exposes site administrators to potential attacks. This vulnerability enables an attacker to exploit the CSRF mechanism to manipulate integrations with services like Zoom and AWeber. If an attacker succeeds, they can replace the stored integration credentials of a logged-in administrator with their own, redirecting data intended for those services to an account controlled by the attacker. Exploitation hinges on having previously established an integration and knowledge of the site's OAuth client identifier, thus heightening the risk for sites using these integrations.
Affected Version(s)
AutomatorWP 0 < 6.0.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.