The AutomatorWP plugin for WordPress suffers from a missing capability check in the automatorwp_ajax_import_automation_from_url function, allowing authenticated users with low privileges (Subscriber-level and above) to create arbitrary automations. These automations can be weaponized to achieve remote code execution or privilege escalation once activated by an administrator. The vulnerability is tracked as CVE-2025-9539 and scored 8.0 on the CVSS v3.1 scale, reflecting high impact on confidentiality, integrity, and availability. The issue affects all versions up to 5.3.6, and no patch or official fix has been documented in the provided data.

An attacker with at least Subscriber-level access can exploit this vulnerability to create arbitrary automations without proper authorization. This can lead to remote code execution or privilege escalation after an administrator activates the malicious automation, potentially compromising the entire WordPress site. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious automation creation. Administrators should be cautious when activating automations created by users with lower privileges.