CVE-2026-126173

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.

• CWE-862

• https://automatorwp.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/04ea5758-2400-4885-8342-c57d61206ef1?source=cve

Published

Nov 14, 2026

Last Modified

Nov 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126167A improper neutralization of special elements used in a comm…7.2
• CVE-2026-126168A improper neutralization of argument delimiters in a comman…7.2
• CVE-2026-126169A improper neutralization of argument delimiters in a comman…7.2
• CVE-2026-12617The issue is unexpected program termination based on orderin…7.5
• CVE-2026-126170A improper encoding or escaping of output vulnerability in F…9.8
• CVE-2026-126171A use of externally-controlled format string vulnerability i…7.2
• CVE-2026-126175A improper neutralization of special elements used in an sql…8.8
• CVE-2026-126176A xml injection (aka blind xpath injection) vulnerability in…8.1
• CVE-2026-126177A xml injection (aka blind xpath injection) vulnerability in…8.1
• CVE-2026-126178A heap-based buffer overflow vulnerability in Fortinet Forti…7.2
• CVE-2026-126179A improper neutralization of special elements used in an os …7.2
• CVE-2026-12618IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.2