The AutomatorWP Pro plugin for WordPress' webhook addon contains an authorization bypass vulnerability in all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset the password of any WordPress account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields set as described in the advisory.