CVE-2026-76074: CWE-862 Missing Authorization in rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress

CVE-2026-76074 is an authorization bypass vulnerability in the AutomatorWP plugin for WordPress (versions up to and including 5.8.4). The plugin fails to properly verify that a user has the necessary permissions before allowing access to the Campaign Monitor mailing list catalog. The nonce required for this action is exposed unconditionally on all WordPress admin pages via wp_localize_script, enabling any authenticated user with subscriber-level access or above to retrieve mailing list IDs and names that should be restricted to users with the plugin's manager capability.

An attacker with subscriber-level or higher access can bypass authorization controls to obtain the Campaign Monitor mailing list catalog, including all list IDs and names. This exposure of mailing list information could lead to privacy concerns and potential misuse of subscriber data. The vulnerability does not allow modification or deletion of data, nor does it impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for any suspicious activity related to mailing list data access. No official fix or patch links have been provided at this time.