CVE-2026-40785: AutomatorWP Authentication Bypass Flaw

CVE-2026-40785 Overview

CVE-2026-40785 is a broken authentication vulnerability affecting the AutomatorWP WordPress plugin in versions up to and including 5.6.7. The flaw allows authenticated users with subscriber-level privileges to bypass intended authentication controls. Successful exploitation can compromise integrity and availability of the WordPress site, while confidentiality impact remains limited. The issue is tracked under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Patchstack disclosed the vulnerability through its WordPress plugin vulnerability database.

Critical Impact
Authenticated subscribers can bypass authentication controls in AutomatorWP <= 5.6.7, enabling unauthorized actions that affect site integrity and availability.

Affected Products

AutomatorWP WordPress plugin versions <= 5.6.7
WordPress sites with AutomatorWP installed and subscriber-level registration enabled
Any deployment exposing low-privileged accounts to the affected plugin endpoints

Discovery Timeline

2026-06-15 - CVE-2026-40785 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40785

Vulnerability Analysis

The vulnerability exists in AutomatorWP, a WordPress automation plugin that connects triggers and actions across plugins and external services. AutomatorWP <= 5.6.7 fails to properly enforce authentication checks on one or more plugin code paths. A user authenticated at the lowest WordPress role, subscriber, can reach functionality intended for higher-privileged contexts. The vulnerability is classified under [CWE-288] as authentication bypass using an alternate path or channel. The attack is network-reachable and requires low attacker complexity. EPSS data places exploitation likelihood at 0.385%.

Root Cause

The root cause is missing or insufficient authentication enforcement on plugin handlers. AutomatorWP exposes triggers, actions, and automation endpoints that should validate the caller's role and capability. When a handler relies only on the presence of a valid WordPress session without checking capabilities, any logged-in user including a subscriber can invoke it. This pattern matches the broken authentication category defined by [CWE-288].

Attack Vector

An attacker first registers or obtains a subscriber account on a target WordPress site running AutomatorWP <= 5.6.7. The attacker then sends authenticated HTTP requests to AutomatorWP endpoints that lack proper capability checks. Because authentication alone is treated as sufficient, the requests succeed and trigger automation logic the subscriber should not control. The impact includes modification of automation state and disruption of site availability. No verified public proof-of-concept is currently available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-40785

Indicators of Compromise

Unexpected AutomatorWP automation runs, triggers fired, or actions executed by subscriber-level accounts in plugin logs.
POST requests to AutomatorWP AJAX or REST endpoints originating from low-privilege user sessions.
New or modified automations in the AutomatorWP configuration that administrators did not create.

Detection Strategies

Audit WordPress access logs for authenticated requests to AutomatorWP endpoints from accounts with the subscriber role.
Review the wp_users and wp_usermeta tables for subscriber accounts created shortly before anomalous automation activity.
Compare current AutomatorWP automation definitions against a known-good baseline to detect unauthorized changes.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward access logs to a central log platform for correlation.
Monitor user role changes and new user registrations on sites that allow public subscriber signup.
Alert on AutomatorWP automation creation, modification, or execution events outside expected administrative windows.

How to Mitigate CVE-2026-40785

Immediate Actions Required

Update AutomatorWP to a version later than 5.6.7 as soon as the vendor publishes a patched release.
Disable public user registration or restrict the default role to a non-subscriber custom role on sites that do not require open signup.
Review existing subscriber accounts and remove any that are unrecognized or inactive.

Patch Information

The vulnerability affects AutomatorWP <= 5.6.7. Site administrators should consult the Patchstack Vulnerability Report and the AutomatorWP plugin changelog on WordPress.org for the fixed version. Apply the vendor-supplied update through the WordPress plugin manager or WP-CLI once available.

Workarounds

Deactivate the AutomatorWP plugin until a fixed version is installed if the site can operate without it.
Restrict access to /wp-admin/admin-ajax.php and AutomatorWP REST routes using a web application firewall rule that blocks subscriber-role requests to those paths.
Set users_can_register to false in WordPress general settings to prevent attackers from obtaining subscriber accounts.

bash

# Configuration example: update AutomatorWP and disable open registration via WP-CLI
wp plugin update automatorwp
wp option update users_can_register 0
wp user list --role=subscriber --fields=ID,user_login,user_registered