{"id":"CVE-2026-118239","kind":"vulnerability","aliases":["CVE-2026-118239"],"related":[],"title":"AutomatorWP WordPress plugin lets attackers replace Zoom and AWeber credentials","description":"The AutomatorWP  WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","summary":"The AutomatorWP WordPress plugin before 6.0.7 does not check who completes its Zoom and AWeber connection flow. An unauthenticated attacker can swap the stored integration credentials for their own and receive the data the site sends to those services.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["automatorwp","aweber","package","wordpress","zoom"],"not_affected_if":["integration-not-connected","plugin-6.0.7-or-later","plugin-not-installed"],"how_to_check":"- Check the installed AutomatorWP version in the WordPress Plugins screen or `wp plugin get automatorwp --field=version`\n- Look under AutomatorWP integration settings to see whether Zoom or AWeber is connected\n- Confirm the OAuth client identifier is set for those integrations","fix":"- AutomatorWP: move to `6.0.7` or later","status":"open","published_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:48+00:00","updated_at":"2026-11-06T06:41:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- AutomatorWP: move to `6.0.7` or later","reach":"internet","title":"AutomatorWP WordPress plugin lets attackers replace Zoom and AWeber credentials","impact":"medium","summary":"The AutomatorWP WordPress plugin before 6.0.7 does not check who completes its Zoom and AWeber connection flow. An unauthenticated attacker can swap the stored integration credentials for their own and receive the data the site sends to those services.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","automatorwp","zoom","aweber"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over stored Zoom and AWeber integration data","analyst_note":"","how_to_check":"- Check the installed AutomatorWP version in the WordPress Plugins screen or `wp plugin get automatorwp --field=version`\n- Look under AutomatorWP integration settings to see whether Zoom or AWeber is connected\n- Confirm the OAuth client identifier is set for those integrations","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","integration-not-connected","plugin-6.0.7-or-later"],"who_is_affected":"Sites running the AutomatorWP WordPress plugin older than 6.0.7 that have the Zoom or AWeber integration connected. Exploitation also requires knowledge of the site's OAuth client identifier, so the risk is limited to those specific integrations. Sites without the plugin or without these integrations connected can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4253,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118239':13A,16A '-2026':12A,15A '6.0.7':27B,66C 'account':109C 'allow':81C,85C 'alreadi':117C 'attack':5A,41B,87C 'automatorwp':1A,17B,23B,62C 'aweb':9A,18B,36B,77C 'check':30B,69C 'client':127C 'complet':32B,73C 'connect':37B,79C,119C 'control':111C 'credenti':10A,47B,93C 'cve':11A,14A 'data':54B,100C 'divert':98C 'exploit':112C 'flow':38B 'identifi':128C 'integr':46B,78C,92C,115C 'knowledg':121C 'let':4A 'oauth':126C 'packag':19B 'plugin':3A,25B,64C 'receiv':52B 'replac':6A,89C 'requir':113C 'send':57B,103C 'servic':60B,106C 'site':56B,102C,124C 'store':45B,91C 'swap':43B 'unauthent':40B,86C 'user':72C 'wordpress':2A,20B,24B,63C 'zoom':7A,21B,34B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AutomatorWP WordPress plugin older than 6.0.7 that have the Zoom or AWeber integration connected. Exploitation also requires knowledge of the site's OAuth client identifier, so the risk is limited to those specific integrations. Sites without the plugin or without these integrations connected can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["automatorwp","aweber","medium","package","wordpress","zoom"],"campaign_type":null,"search_a":"'-118239':13A,16A '-2026':12A,15A 'attack':5A 'automatorwp':1A 'aweb':9A 'credenti':10A 'cve':11A,14A 'let':4A 'plugin':3A 'replac':6A 'wordpress':2A 'zoom':7A","search_b":"'6.0.7':27B 'attack':41B 'automatorwp':17B,23B 'aweb':18B,36B 'check':30B 'complet':32B 'connect':37B 'credenti':47B 'data':54B 'flow':38B 'integr':46B 'packag':19B 'plugin':25B 'receiv':52B 'send':57B 'servic':60B 'site':56B 'store':45B 'swap':43B 'unauthent':40B 'wordpress':20B,24B 'zoom':21B,34B","search_c":"'6.0.7':66C 'account':109C 'allow':81C,85C 'alreadi':117C 'attack':87C 'automatorwp':62C 'aweb':77C 'check':69C 'client':127C 'complet':73C 'connect':79C,119C 'control':111C 'credenti':93C 'data':100C 'divert':98C 'exploit':112C 'identifi':128C 'integr':78C,92C,115C 'knowledg':121C 'oauth':126C 'plugin':64C 'replac':89C 'requir':113C 'send':103C 'servic':106C 'site':102C,124C 'store':91C 'unauthent':86C 'user':72C 'wordpress':63C 'zoom':75C","first_public_at":"2026-11-06T06:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118239","severity":null,"published_at":"2026-11-06T06:16:41+00:00","modified_at":"2026-11-06T06:16:41+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}