---
id: "CVE-2026-118239"
page: "https://infrastack.ai/live/CVE-2026-118239"
kind: "vulnerability"
aliases: ["CVE-2026-118239"]
title: "AutomatorWP WordPress plugin lets attackers replace Zoom and AWeber credentials"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["automatorwp", "aweber", "package", "wordpress", "zoom"]
not_affected_if: ["integration-not-connected", "plugin-6.0.7-or-later", "plugin-not-installed"]
published_at: "2026-11-06T06:16:41+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118239", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# AutomatorWP WordPress plugin lets attackers replace Zoom and AWeber credentials

Link for people: https://infrastack.ai/live/CVE-2026-118239 (this .md is for agents)

The AutomatorWP WordPress plugin before 6.0.7 does not check who completes its Zoom and AWeber connection flow. An unauthenticated attacker can swap the stored integration credentials for their own and receive the data the site sends to those services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AutomatorWP version in the WordPress Plugins screen or `wp plugin get automatorwp --field=version`
- Look under AutomatorWP integration settings to see whether Zoom or AWeber is connected
- Confirm the OAuth client identifier is set for those integrations

## Fix

- AutomatorWP: move to `6.0.7` or later

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118239

## From the sources

The AutomatorWP  WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_