Automatorwp No Code Workflow Automation Integration Webhooks Plugin Now With Ai
Monthly
Authenticated subscribers (or any logged-in user) on WordPress sites running the AutomatorWP plugin up to and including 5.8.4 can enumerate Fluent Forms records - specifically form IDs and titles from the fluentform_forms database table - because a plugin AJAX handler performs no authorization check. The flaw is network-reachable but requires a valid low-privilege account plus the Fluent Forms plugin and AutomatorWP's Fluent Forms integration to be active, and exposure is limited to form identifiers and titles rather than submissions or configuration data (CVSS 4.3, CWE-862). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); overall this is a genuinely low-priority information-disclosure defect.
Authenticated subscribers (or any logged-in user) on WordPress sites running the AutomatorWP plugin up to and including 5.8.4 can enumerate Fluent Forms records - specifically form IDs and titles from the fluentform_forms database table - because a plugin AJAX handler performs no authorization check. The flaw is network-reachable but requires a valid low-privilege account plus the Fluent Forms plugin and AutomatorWP's Fluent Forms integration to be active, and exposure is limited to form identifiers and titles rather than submissions or configuration data (CVSS 4.3, CWE-862). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); overall this is a genuinely low-priority information-disclosure defect.