{"id":"CVE-2026-121472","kind":"vulnerability","aliases":["CVE-2026-121472"],"related":[],"title":"AutomatorWP WordPress plugin: CSRF lets attackers swap Zoom and AWeber credentials","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","summary":"The AutomatorWP WordPress plugin before 6.0.8 does not tie the OAuth flows for its Zoom and AWeber integrations to the administrator who started them. An attacker can use a cross-site request forgery attack to make a logged-in administrator replace the stored integration credentials with the attacker's own, redirecting data sent to those services.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["automatorwp","aweber","package","wordpress","zoom"],"not_affected_if":["integration-not-connected","version-6.0.8-or-later"],"how_to_check":"- Check the installed AutomatorWP version in the WordPress plugins list or `wp plugin get automatorwp --field=version`\n- Check whether the Zoom or AWeber integration is connected under the AutomatorWP settings","fix":"- AutomatorWP WordPress plugin: `6.0.8`","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:33+00:00","updated_at":"2026-11-11T06:27:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:33Z","model":"claude-haiku-5-5","output":{"fix":"- AutomatorWP WordPress plugin: `6.0.8`","reach":"internet","title":"AutomatorWP WordPress plugin: CSRF lets attackers swap Zoom and AWeber credentials","impact":"medium","summary":"The AutomatorWP WordPress plugin before 6.0.8 does not tie the OAuth flows for its Zoom and AWeber integrations to the administrator who started them. An attacker can use a cross-site request forgery attack to make a logged-in administrator replace the stored integration credentials with the attacker's own, redirecting data sent to those services.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","automatorwp","zoom","aweber"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker redirects integration data to their own Zoom or AWeber account","analyst_note":"\"\"","how_to_check":"- Check the installed AutomatorWP version in the WordPress plugins list or `wp plugin get automatorwp --field=version`\n- Check whether the Zoom or AWeber integration is connected under the AutomatorWP settings\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.0.8-or-later","integration-not-connected"],"who_is_affected":"Sites running AutomatorWP before 6.0.8 that have the Zoom or AWeber integration connected. Exposure needs an attacker to know the site's OAuth client identifier and to trick a logged-in administrator into a crafted request. Sites without those integrations connected, or already on 6.0.8 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4606,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121472':14A,17A '-2026':13A,16A '6.0.8':28B,86C 'account':140C 'administr':43B,64B,102C,114C 'allow':106C 'alreadi':149C 'attack':6A,48B,57B,72B,107C,122C,128C,142C 'automatorwp':1A,18B,24B,82C 'aweb':10A,19B,39B,97C 'bind':89C 'client':159C 'complet':93C 'connect':99C,151C 'control':143C 'credenti':11A,69B,119C 'cross':53B 'cross-sit':52B 'csrf':4A,127C 'cve':12A,15A 'data':76B,131C 'divert':129C 'exploit':144C 'flow':34B 'forgeri':56B 'identifi':160C 'integr':40B,68B,98C,118C,147C 'knowledg':153C 'let':5A 'log':62B,112C 'logged-in':61B,111C 'make':59B,109C 'oauth':33B,158C 'packag':20B 'plugin':3A,26B,84C 'redirect':75B 'replac':65B,115C 'request':55B,91C 'requir':145C 'send':134C 'sent':77B 'servic':80B,137C 'site':54B,133C,156C 'start':45B,104C 'store':67B,117C 'swap':7A 'tie':31B 'use':50B 'via':125C 'wordpress':2A,21B,25B,83C 'zoom':8A,22B,37B,95C","nicknames":[],"mitigations":[],"who_affected":"Sites running AutomatorWP before 6.0.8 that have the Zoom or AWeber integration connected. Exposure needs an attacker to know the site's OAuth client identifier and to trick a logged-in administrator into a crafted request. Sites without those integrations connected, or already on 6.0.8 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["automatorwp","aweber","medium","package","wordpress","zoom"],"campaign_type":null,"search_a":"'-121472':14A,17A '-2026':13A,16A 'attack':6A 'automatorwp':1A 'aweb':10A 'credenti':11A 'csrf':4A 'cve':12A,15A 'let':5A 'plugin':3A 'swap':7A 'wordpress':2A 'zoom':8A","search_b":"'6.0.8':28B 'administr':43B,64B 'attack':48B,57B,72B 'automatorwp':18B,24B 'aweb':19B,39B 'credenti':69B 'cross':53B 'cross-sit':52B 'data':76B 'flow':34B 'forgeri':56B 'integr':40B,68B 'log':62B 'logged-in':61B 'make':59B 'oauth':33B 'packag':20B 'plugin':26B 'redirect':75B 'replac':65B 'request':55B 'sent':77B 'servic':80B 'site':54B 'start':45B 'store':67B 'tie':31B 'use':50B 'wordpress':21B,25B 'zoom':22B,37B","search_c":"'6.0.8':86C 'account':140C 'administr':102C,114C 'allow':106C 'alreadi':149C 'attack':107C,122C,128C,142C 'automatorwp':82C 'aweb':97C 'bind':89C 'client':159C 'complet':93C 'connect':99C,151C 'control':143C 'credenti':119C 'csrf':127C 'data':131C 'divert':129C 'exploit':144C 'identifi':160C 'integr':98C,118C,147C 'knowledg':153C 'log':112C 'logged-in':111C 'make':109C 'oauth':158C 'plugin':84C 'replac':115C 'request':91C 'requir':145C 'send':134C 'servic':137C 'site':133C,156C 'start':104C 'store':117C 'via':125C 'wordpress':83C 'zoom':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121472","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}