CVE-2026-76074: AutomatorWP WordPress Auth Bypass Vulnerability

CVE-2026-76074 Overview

CVE-2026-76074 is an authorization bypass vulnerability in the AutomatorWP plugin for WordPress, a no-code automation, webhooks, and custom integrations tool. The flaw affects all versions up to and including 5.8.4. The plugin fails to verify that a user holds the required manager capability before returning the site's configured Campaign Monitor mailing list catalog. Authenticated attackers with subscriber-level access can retrieve all list IDs and names via an AJAX endpoint. The required nonce is emitted unconditionally on every WordPress admin page through wp_localize_script, so any subscriber loading /wp-admin/profile.php can obtain it. The issue is categorized under CWE-862: Missing Authorization.

Critical Impact
Any authenticated subscriber can exfiltrate the site's Campaign Monitor mailing list catalog, exposing integration metadata that should be restricted to plugin managers.

Affected Products

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations
WordPress installations running AutomatorWP versions ≤ 5.8.4
Sites using the plugin's Campaign Monitor integration

Discovery Timeline

2026-08-22 - CVE-2026-76074 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76074

Vulnerability Analysis

The vulnerability lives in the Campaign Monitor integration's AJAX handler shipped with AutomatorWP. The handler responds to a request for the configured Campaign Monitor mailing list catalog but only checks that the caller is authenticated and presents a valid nonce. It never confirms that the caller holds the plugin's manager capability, which is the intended authorization boundary for integration configuration data. A subscriber-level account is sufficient to invoke the endpoint and receive the full list of Campaign Monitor list IDs and names configured on the site.

Compounding the issue, the nonce required by the AJAX handler is registered globally through wp_localize_script in includes/scripts.php. Every authenticated user who loads any wp-admin page, including /wp-admin/profile.php, receives this nonce in the page source. Subscribers therefore possess both the credential and the endpoint needed to complete the request without any elevated access.

Root Cause

The root cause is a missing capability check in the Campaign Monitor AJAX functions defined in integrations/campaign-monitor/includes/ajax-functions.php. The handler relies on nonce verification and authentication alone rather than calling current_user_can() against the plugin's manager capability before returning integration data.

Attack Vector

Exploitation requires network access to the WordPress site and a valid subscriber-level account or higher. The attacker authenticates, loads any admin page to harvest the localized nonce, then issues an admin-ajax.php POST request to the Campaign Monitor list endpoint. The server responds with the configured mailing list catalog. No user interaction from a privileged account is required.

Code-level details are available in the vendor references: AutomatorWP scripts.php L161, Campaign Monitor ajax-functions.php L89, and Campaign Monitor ajax-functions.php L124.

Detection Methods for CVE-2026-76074

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php originating from subscriber accounts targeting AutomatorWP Campaign Monitor actions.
Access log entries showing subscriber sessions retrieving JSON responses containing Campaign Monitor list IDs and names.
Anomalous frequency of wp-admin/profile.php loads followed immediately by AJAX calls to AutomatorWP endpoints.

Detection Strategies

Inspect web server logs for admin-ajax.php requests carrying AutomatorWP action parameters associated with Campaign Monitor integration and correlate the calling user's role.
Enable WordPress audit logging to record AJAX action invocations, response sizes, and originating user roles for the AutomatorWP plugin.
Deploy a web application firewall rule that flags subscriber-level users invoking plugin manager endpoints exposed by AutomatorWP.

Monitoring Recommendations

Alert on any non-administrator account issuing requests to AutomatorWP Campaign Monitor AJAX actions.
Track the installed AutomatorWP plugin version across managed WordPress properties and flag any host still on 5.8.4 or earlier.
Review Campaign Monitor account activity for unexpected use of list identifiers that may have been harvested from a compromised site.

How to Mitigate CVE-2026-76074

Immediate Actions Required

Update AutomatorWP to the version released in the fix changeset 3656285 on every WordPress site running the plugin.
Audit current subscriber and low-privilege accounts, removing dormant or unrecognized users that could be used to authenticate the attack.
Rotate Campaign Monitor API credentials if unauthorized enumeration of the mailing list catalog is suspected.

Patch Information

The vendor addressed the missing authorization check in the AutomatorWP source tree. Reference the Wordfence vulnerability analysis and the AutomatorWP changeset for the corrected ajax-functions.php implementation, which adds a capability check before returning Campaign Monitor list data.

Workarounds

Disable the AutomatorWP Campaign Monitor integration until the patched version can be deployed.
Restrict subscriber registration and enforce strong role review to reduce the population of accounts that could invoke the vulnerable endpoint.
Place the /wp-admin/admin-ajax.php endpoint behind additional WAF rules that block AutomatorWP Campaign Monitor actions from non-manager users.

bash

# Configuration example: verify installed AutomatorWP version via WP-CLI
wp plugin get automatorwp --field=version
# Update to the patched release once available
wp plugin update automatorwp