CVE-2026-118239 · Package
NO FIX YET · SEE WHAT TO DO
The AutomatorWP WordPress plugin before 6.0.7 does not check who completes its Zoom and AWeber connection flow. An unauthenticated attacker can swap the stored integration credentials for their own and receive the data the site sends to those services.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the AutomatorWP WordPress plugin older than 6.0.7 that have the Zoom or AWeber integration connected. Exploitation also requires knowledge of the site's OAuth client identifier, so the risk is limited to those specific integrations. Sites without the plugin or without these integrations connected can skip it.
Not affected if integration-not-connected, plugin-6.0.7-or-later, plugin-not-installed
Who cares automatorwp, aweber, wordpress, zoom
wp plugin get automatorwp --field=version6.0.7 or laterThe AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.