CVE-2026-76057 Overview
CVE-2026-76057 is an authorization bypass vulnerability in the AutomatorWP WordPress plugin, a no-code automation and integration tool. The flaw affects all versions up to and including 5.8.4. The plugin fails to verify whether the requesting user is permitted to perform ConvertKit-related actions. Authenticated attackers with subscriber-level access or above can retrieve ConvertKit form data configured by the site's manager account. The required nonce is localized on every admin page load, making it available to any authenticated user reaching /wp-admin. This exposes integration details intended to be restricted to plugin managers, classified under [CWE-862] Missing Authorization.
Critical Impact
Subscriber-level users can read ConvertKit integration data configured by higher-privileged managers, leaking third-party integration details.
Affected Products
- AutomatorWP plugin for WordPress, versions up to and including 5.8.4
- WordPress sites using the ConvertKit integration module within AutomatorWP
- Installations exposing /wp-admin to authenticated subscriber-tier accounts
Discovery Timeline
- 2026-08-22 - CVE-2026-76057 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-76057
Vulnerability Analysis
The vulnerability resides in the ConvertKit integration AJAX handlers of AutomatorWP. These handlers process requests tied to ConvertKit form retrieval and configuration but do not enforce capability checks that restrict access to plugin managers. Any authenticated user, including a subscriber, can invoke the affected AJAX endpoints and receive ConvertKit form data.
AutomatorWP localizes the required security nonce on every admin page load through the plugin's script registration logic in includes/scripts.php. Because subscribers can reach /wp-admin, they can extract the nonce from page source and issue the AJAX requests. The vulnerability is limited to confidentiality impact; there is no integrity or availability effect.
Root Cause
The root cause is missing authorization in the ConvertKit AJAX callbacks located in integrations/convertkit/includes/ajax-functions.php. The functions verify the nonce but do not call current_user_can() with a manager-level capability. Nonce verification confirms request origin, not authorization. Without a capability check, all authenticated users pass the gate.
Attack Vector
An attacker registers or logs in as a subscriber on the target WordPress site. The attacker loads any /wp-admin page to harvest the localized AutomatorWP nonce. The attacker then submits a POST request to the WordPress admin-ajax.php endpoint, invoking the affected ConvertKit action with the harvested nonce. The server returns ConvertKit form data configured by the site's manager. Refer to the Wordfence Vulnerability Report and the AutomatorWP ConvertKit AJAX Function source for technical details.
Detection Methods for CVE-2026-76057
Indicators of Compromise
- POST requests to wp-admin/admin-ajax.php with AutomatorWP ConvertKit action names originating from low-privilege user sessions
- Unusual admin page loads by subscriber-role accounts immediately followed by AJAX calls
- Access log entries showing subscriber user IDs retrieving ConvertKit form identifiers
Detection Strategies
- Review WordPress access logs for admin-ajax.php calls tied to AutomatorWP ConvertKit actions from non-manager users
- Correlate authentication events with subsequent AJAX activity by newly registered subscriber accounts
- Enable verbose plugin logging to record which user role invoked each ConvertKit AJAX handler
Monitoring Recommendations
- Monitor for spikes in new subscriber registrations followed by admin panel access
- Track outbound API traffic to ConvertKit that does not match expected automation schedules
- Alert on responses from admin-ajax.php containing ConvertKit form structures returned to non-manager sessions
How to Mitigate CVE-2026-76057
Immediate Actions Required
- Update the AutomatorWP plugin to the version released after 5.8.4 that includes the authorization fix referenced in the AutomatorWP changeset history
- Audit user roles and remove unused subscriber accounts, especially those created recently
- Rotate any ConvertKit API credentials that may have been exposed through the integration
Patch Information
The vendor addressed the authorization bypass in the AutomatorWP repository. Site administrators should upgrade to the latest available version through the WordPress plugin manager. Verify the fix by reviewing the referenced changeset which adds capability checks to the ConvertKit AJAX handlers.
Workarounds
- Disable the AutomatorWP ConvertKit integration until the patched version is installed
- Restrict /wp-admin access to trusted IP ranges using web server or WAF rules
- Disable open user registration or require administrator approval for new accounts to limit subscriber-tier exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
