The AutomatorWP – Automator plugin for WordPress contains a time-based SQL Injection vulnerability (CWE-89) in the field_conditions parameter. Due to improper neutralization of special elements in SQL commands, authenticated users with Administrator privileges can append malicious SQL queries to existing ones. This vulnerability affects all versions up to 5.2.3 and can be exploited to extract sensitive information from the database. The plugin's configuration options may allow authors and higher roles to access the vulnerable functionality, increasing risk. The CVSS 3.1 score is 7.2, indicating high severity. No patch or official fix information is currently available.

Successful exploitation allows authenticated users with Administrator or higher privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information, modification, or deletion of data. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress plugin's data. The ability to escalate impact depends on the roles granted access to the vulnerable functionality, which may include authors if configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AutomatorWP plugin functionality to only trusted Administrator users and review role permissions to ensure authors or lower privileged users do not have access to the vulnerable features. Monitor vendor channels for updates and apply patches promptly once released.