What the vulnerability does
01Description
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
Explanation of Vulnerability in Simple Terms
02Summary
AutomatorWP versions up to 5.3.6 contain a code injection vulnerability in webhook or automation processing. An authenticated user with low privileges can inject and execute arbitrary PHP code by crafting a malicious webhook payload or automation rule, provided they can trick a site administrator into viewing or triggering the payload. This allows complete site compromise including data theft and malware installation.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site and access all data, modify content, or install malware.
Potential impact on your site
04Site Impact
Complete site compromise possible; attacker can steal data, modify posts, create admin accounts, or inject malware.
Conditions required to exploit
05Prerequisites
Low-level user account (subscriber or contributor) and victim must interact with attacker-controlled content (click link, view page).
Key dates
06Disclosure timeline
September 9, 2025
CVE published
April 8, 2026
Record updated
