CVE-2026-121472 · Package
NO FIX YET · SEE WHAT TO DO
The AutomatorWP WordPress plugin before 6.0.8 does not tie the OAuth flows for its Zoom and AWeber integrations to the administrator who started them. An attacker can use a cross-site request forgery attack to make a logged-in administrator replace the stored integration credentials with the attacker's own, redirecting data sent to those services.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running AutomatorWP before 6.0.8 that have the Zoom or AWeber integration connected. Exposure needs an attacker to know the site's OAuth client identifier and to trick a logged-in administrator into a crafted request. Sites without those integrations connected, or already on 6.0.8 or later, are not affected.
Not affected if integration-not-connected, version-6.0.8-or-later
Who cares automatorwp, aweber, wordpress, zoom
wp plugin get automatorwp --field=version6.0.8The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.