External risk intelligence

AutomatorWP Pro WordPress Plugin Authorization Bypass Leading to Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-126173

The vulnerability affects a WordPress plugin designed to process webhooks. Webhook endpoints are typically exposed to the public internet to receive events from external services, making this functionality a common internet-facing integration point in WordPress deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the AutomatorWP Pro WordPress plugin's webhook feature that could allow unauthorized individuals to reset any user's password, including administrator accounts. This could lead to a complete takeover of WordPress accounts. The exploit requires a specific, documented configuration within the plugin, involving the pairing of a Receive Webhook trigger with an Update-User action under certain conditions.

Unauthenticated users can reset WordPress passwords.
This allows full account takeover of any user.
Confirm if your WordPress webhook is configured correctly.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by leveraging a specific configuration within the AutomatorWP Pro plugin's webhook addon. By sending a specially crafted webhook request to a WordPress site where an administrator has set up a particular automation, an attacker can bypass authorization checks and reset the password of any user account, including administrative ones, leading to a full account takeover. This is only possible when the plugin's webhook feature is configured to process specific trigger and action pairings, and the user ID field is left blank while the password field is mapped to the webhook's password tag.

No authentication required.
Triggered by a specific webhook configuration.
Leads to complete account takeover.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could reset the password for any WordPress account, including administrators, by exploiting a specific configuration of the AutomatorWP Pro plugin's webhook addon. This could lead to a full takeover of affected WordPress accounts when a particular webhook trigger is paired with an update-user action, and the user ID is left blank while the password field is mapped to the webhook password tag.

Administrator account credentials.
Unauthenticated attackers can send specially crafted webhooks.
Complete takeover of WordPress accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a WordPress plugin requires a coordinated response. Platform or application teams managing WordPress instances, alongside the security team, must prioritize identifying all deployments of the affected plugin. Once located, assess reachability and business criticality to confirm accountable owners and plan remediation within established maintenance windows, coordinating with the plugin vendor as needed.

WordPress administrators own the issue.
Verify webhook configurations and internet exposure.
Plan remediation and coordinate with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AutomatorWP Pro?

AutomatorWP Pro is a plugin for WordPress that allows users to create automated workflows by connecting different plugins and services. It includes a webhook addon, which is designed to listen for and process data sent from external applications. This allows site administrators to trigger specific actions on their WordPress site—such as updating user information—whenever the webhook receives a signal from an outside source.

What is the vulnerability in CVE-2026-126173?

This vulnerability is classified as CWE-862, which is an Improper Authorization weakness. Essentially, the software fails to confirm that a person is actually allowed to perform a specific action. Because of this oversight, someone who is not logged into the site can bypass the system's security checks and trigger a password reset for any user, including administrators, which leads to full account takeover.

How is this vulnerability triggered?

The flaw is not triggered by default in all setups; it requires a very specific, documented configuration. An attacker can only exploit this if an administrator has set up an automation that pairs a 'Receive Webhook' trigger with an 'Update-User' action where the User ID field is intentionally left blank. If these specific conditions are not met—or if the workflow is configured differently—this specific path to unauthorized password modification does not exist.

Why should I care about this CVE?

You should care because this plugin uses webhooks, which are often intentionally placed on the public internet to communicate with third-party services. According to Halo Surface Signal, this makes the affected functionality an internet-facing integration point. Because an attacker does not need an account to interact with these public endpoints, the potential for unauthorized access is high if your specific automation configuration matches the vulnerable pattern.

How do I respond if I use AutomatorWP Pro?

Your first step is to audit your WordPress environment to identify if you have the AutomatorWP Pro plugin installed. If you find it, check your automation workflows to see if you are using the webhook addon with an 'Update-User' action. If you identify a configuration that matches the description, consider temporarily disabling those specific automations while you coordinate with your team to review the vendor's guidance for a fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.