---
id: "CVE-2026-126173"
page: "https://infrastack.ai/live/CVE-2026-126173"
kind: "vulnerability"
aliases: ["CVE-2026-126173"]
title: "AutomatorWP Pro webhook addon: unauthenticated password reset enables admin takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["automatorwp", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "no-webhook-addon"]
published_at: "2026-11-14T05:18:37+00:00"
first_seen_at: "2026-11-14T05:27:43+00:00"
updated_at: "2026-11-14T05:29:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126173", "first_seen_at": "2026-11-14T05:27:43+00:00"}]
exploit_sources: []
---

# AutomatorWP Pro webhook addon: unauthenticated password reset enables admin takeover

Link for people: https://infrastack.ai/live/CVE-2026-126173 (this .md is for agents)

The AutomatorWP Pro webhook addon for WordPress, in versions up to and including 1.4.4, does not check that a caller is authorized before performing an action. An unauthenticated attacker can reset the password of any WordPress account, including administrators, and take the account over.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AutomatorWP Pro version in the WordPress plugins screen; versions `1.4.4` and below are in range.
- Review automations that use a Receive Webhook trigger with an 'Is the user ID' field feeding an Update-User action with a blank User ID and a Password field mapped to the webhook password tag.

## Fix

- AutomatorWP Pro webhook addon: versions above `1.4.4` per the description; the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-14T05:27:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126173

## From the sources

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_