Threats tagged 'ghsa-wrfm-3g59-7fq9'

The AutomatorWP WordPress plugin up to version 6.0.4 contains a privilege escalation vulnerability. This flaw arises from insufficient privilege validation in the create_user() function when used in anonymous-user actions or certain WordPress integration actions. An attacker can exploit this by triggering an automation configured to assign roles dynamically from user-controlled data, such as comment author fields, allowing creation of an administrator account without authentication. Exploitation requires a specific automation setup and is triggered by routine admin actions like comment approval, which does not alert the admin to the creation of a privileged account.