CVE-2026-126173: Critical Vulnerability in AutomatorWP Pro Plugin for WordPress

Introduction

The CVE-2026-126173 vulnerability affects the AutomatorWP Pro plugin for WordPress, specifically its webhook addon. This security flaw allows unauthenticated attackers to bypass authorization and reset the password of any WordPress account, including administrator accounts.

What happened?

The AutomatorWP Pro plugin has an authorization bypass flaw that allows unauthenticated users to perform actions that should be restricted. The vulnerability is triggered when an administrator improperly configures an automation that pairs a Receive Webhook trigger with an Update User action, leaving the User ID field blank and mapping the Password field to the webhook password tag.

How the vulnerability works

The flaw occurs due to inadequate verification that a user is authorized to perform a specific action. When an administrator sets up the automation incorrectly, an attacker can exploit this configuration to reset the password of any account, resulting in potential full account takeover.

What is the real impact?

The impact of this vulnerability is critical, as it allows unauthenticated attackers to access and control user accounts, including administrators. This can lead to significant security compromises, including data manipulation, malware installation, and other malicious activities.

Which versions are affected?

• 1.4.4 and earlier

How to fix

1. Update the AutomatorWP Pro plugin to the latest available version.
2. Review automation settings to ensure User ID and Password fields are configured correctly.
3. Consider disabling the webhook addon until an official fix is available.

Mitigation while you update

While updating is not possible, it is recommended to disable the webhook addon or carefully review existing automations to avoid configurations that could be exploited.

Conclusion

The CVE-2026-126173 vulnerability in the AutomatorWP Pro plugin poses a significant risk to the security of WordPress accounts. It is crucial for users of the plugin to take immediate action to rectify the situation and protect their accounts.