CVE-2026-126173

Name of the Vulnerable Software and Affected Versions AutomatorWP Pro versions prior to 1.4.5

Description An authorization bypass exists in the webhook addon of the AutomatorWP Pro plugin for WordPress. The issue occurs because the plugin fails to properly verify if a user is authorized to perform a specific action. This allows unauthenticated attackers to reset the password of any WordPress account, including those with administrator privileges, leading to full account takeover. This is exploitable when an administrator configures an automation that pairs a Receive Webhook trigger containing an Is the user ID field with an Update-User action where the User ID field is blank and the Password field is mapped to the webhook password tag.

Recommendations Update AutomatorWP Pro to version 1.4.5 or later.