CVE-2026-76057: CWE-862 Missing Authorization in rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

CVE-2026-76057 is an authorization bypass vulnerability in the AutomatorWP – Automator plugin for WordPress, affecting all versions up to and including 5.8.4. The plugin fails to properly verify that a user is authorized to perform certain actions, enabling authenticated users with subscriber-level privileges or higher to retrieve ConvertKit form data configured by the site's manager account. The vulnerability is due to the nonce required for authorization being localized on every admin page load, allowing any authenticated user with access to /wp-admin to exploit this flaw.

An attacker with subscriber-level or higher access can retrieve sensitive ConvertKit form data configured by the site manager. This exposure leaks integration details that should be restricted, potentially leading to unauthorized access to external services or data leakage. The vulnerability does not impact system availability or integrity but compromises confidentiality of integration configurations.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict authenticated user roles carefully and limit subscriber-level access to trusted users. Review and control access to the WordPress admin area to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.