Automatorwp Automator Plugin For No Code Automations Webhooks Custom Integrations In Wordpress
Monthly
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.