CVE-2025-9542: CWE-862 Missing Authorization in rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.
AI Analysis
Technical Summary
The AutomatorWP plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in multiple functions, allowing authenticated users with minimal privileges (Subscriber-level and above) to bypass capability checks. This enables unauthorized access to modify integration settings and view automations. The vulnerability affects all versions up to 5.3.7 and has a CVSS 3.1 base score of 5.4, reflecting its medium severity with network attack vector, low complexity, and no user interaction required.
Potential Impact
An attacker with authenticated Subscriber-level access or higher can view and modify integration settings and automations within the plugin, potentially leading to unauthorized changes in automation workflows. The confidentiality and integrity of the plugin's data are impacted, but availability is not affected. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only to minimize risk. Monitor for updates from the vendor and apply patches promptly once released.
CVE-2025-9542: CWE-862 Missing Authorization in rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
Description
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AutomatorWP plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in multiple functions, allowing authenticated users with minimal privileges (Subscriber-level and above) to bypass capability checks. This enables unauthorized access to modify integration settings and view automations. The vulnerability affects all versions up to 5.3.7 and has a CVSS 3.1 base score of 5.4, reflecting its medium severity with network attack vector, low complexity, and no user interaction required.
Potential Impact
An attacker with authenticated Subscriber-level access or higher can view and modify integration settings and automations within the plugin, potentially leading to unauthorized changes in automation workflows. The confidentiality and integrity of the plugin's data are impacted, but availability is not affected. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only to minimize risk. Monitor for updates from the vendor and apply patches promptly once released.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-08-27T13:37:06.045Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68bfcdd7fab242a8024d3088
Added to database: 9/9/2025, 6:48:55 AM
Last enriched: 4/9/2026, 6:13:07 PM
Last updated: 5/13/2026, 8:59:21 PM
Views: 172
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.