Authorization Bypass Vulnerability in AutomatorWP Pro Plugin for WordPress

CVE-2026-126173

What is CVE-2026-126173?

The AutomatorWP Pro plugin's webhook addon is susceptible to an authorization bypass flaw in versions up to and including 1.4.4. The vulnerability arises from inadequate verification of user permissions, enabling unauthenticated attackers to reset passwords for any WordPress account, including those with administrative privileges. This exploitation occurs when administrators set up an automation combining a Receive Webhook trigger with an 'Is the user ID' field and an Update-User action, where the User ID is left blank and the Password is configured to map to the webhook password tag. This misconfiguration poses a significant risk, allowing unauthorized access and control over user accounts.

References