CVE-2026-126173 · Package
NO FIX YET · SEE WHAT TO DO
The AutomatorWP Pro webhook addon for WordPress, in versions up to and including 1.4.4, does not check that a caller is authorized before performing an action. An unauthenticated attacker can reset the password of any WordPress account, including administrators, and take the account over.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AutomatorWP Pro webhook addon at version 1.4.4 or lower are exposed, and only when an administrator has configured a Receive Webhook trigger to an Update-User action with a blank User ID and the password mapped to the webhook password tag. Sites without the addon or without that automation configuration are not exploitable through this path. The sources do not give a fixed version.
Not affected if default-config, no-webhook-addon
Who cares automatorwp, self-hosted, wordpress
1.4.4 and below are in range.1.4.4 per the description; the exact fixed version is unknown from the sources.The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.