CVE advisoryCRITICAL
CVE-2026-126173
AutomatorWP Pro WordPress Plugin Authorization Bypass Leading to Account Takeover.
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical authorization bypass vulnerability in the AutomatorWP Pro WordPress plugin's webhook addon allows unauthenticated attackers to reset any user's password, including administrators. This can lead to full account takeover. The exploit requires a specific, documented plugin configuration involving webhook trigge