CVE-2026-78266: AutomatorWP Authentication Bypass Vulnerability

CVE-2026-78266 Overview

CVE-2026-78266 is a broken access control vulnerability affecting the AutomatorWP WordPress plugin in versions 5.8.3 and earlier. The flaw allows authenticated users with only Subscriber-level privileges to invoke functionality that should be restricted to higher-privileged roles. This maps to CWE-862: Missing Authorization, where the application fails to perform capability checks on sensitive actions. Because AutomatorWP orchestrates automations across a WordPress site, unauthorized invocation of plugin actions can modify integrity-sensitive data. The Patchstack advisory tracks this issue against the affected AutomatorWP releases.

Critical Impact
An authenticated Subscriber can bypass authorization checks in AutomatorWP <= 5.8.3 and perform actions that should require elevated privileges, resulting in a high impact to data integrity.

Affected Products

AutomatorWP plugin for WordPress, versions <= 5.8.3
WordPress sites permitting open Subscriber registration with AutomatorWP installed
Environments where AutomatorWP automations touch integrity-sensitive data or workflows

Discovery Timeline

2026-08-24 - CVE-2026-78266 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78266

Vulnerability Analysis

AutomatorWP exposes plugin endpoints intended for administrative or editor use. In versions up to and including 5.8.3, one or more of these endpoints do not enforce a capability check appropriate to the sensitivity of the action. A user authenticated at the Subscriber role, which is the lowest standard WordPress role, can reach these endpoints and trigger integrity-affecting operations.

The CVSS vector reflects a network-reachable attack requiring low privileges and no user interaction, with impact concentrated on integrity rather than confidentiality or availability. This pattern is typical of broken access control issues in WordPress plugins that rely on authentication alone rather than pairing authentication with a current_user_can() capability check or a properly scoped nonce.

Root Cause

The root cause is missing authorization ([CWE-862]) on plugin action handlers. AutomatorWP registers callbacks reachable by any authenticated session, but the handler does not verify that the caller holds a capability such as manage_options or edit_posts before executing privileged logic. Nonce verification, if present, only proves request origin and does not substitute for capability enforcement.

Attack Vector

An attacker first obtains a Subscriber account, either through open self-registration or by compromising an existing low-privilege user. The attacker then issues an authenticated HTTP request to the vulnerable AutomatorWP endpoint. Because the endpoint does not gate on user capability, the plugin processes the request and performs the action with plugin-level authority. No verified public proof-of-concept code is available at this time; refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-78266

Indicators of Compromise

Requests to AutomatorWP AJAX or REST endpoints under /wp-admin/admin-ajax.php or /wp-json/automatorwp/ originating from accounts with the subscriber role.
Unexpected creation, modification, or execution of AutomatorWP automations, triggers, or actions in the plugin's database tables.
Sudden spikes in new Subscriber registrations followed by authenticated POST requests to plugin endpoints.

Detection Strategies

Enable WordPress audit logging to record capability-check failures, automation changes, and plugin configuration edits.
Correlate web server logs against the WordPress user role of the authenticating session to flag low-privilege users hitting privileged endpoints.
Alert on any AutomatorWP write operation performed by a user whose role is not Administrator, Editor, or Author.

Monitoring Recommendations

Monitor /wp-admin/admin-ajax.php traffic for AutomatorWP-specific action= parameters invoked by non-administrative sessions.
Track changes to AutomatorWP database tables and export a daily diff of automation definitions for review.
Watch for outbound webhook or integration traffic triggered by AutomatorWP outside expected business hours.

How to Mitigate CVE-2026-78266

Immediate Actions Required

Update AutomatorWP to a version later than 5.8.3 as soon as the vendor publishes a fixed release referenced in the Patchstack advisory.
Disable open user registration or restrict the default role for new users to a non-privileged state while the patch is applied.
Audit existing Subscriber accounts and remove any that are not required for site operation.

Patch Information

Consult the Patchstack Vulnerability Report for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or via WP-CLI, then verify the installed version is greater than 5.8.3.

Workarounds

Deactivate the AutomatorWP plugin until an updated version is installed if the plugin is not business-critical.
Place a Web Application Firewall (WAF) rule that blocks AutomatorWP endpoint requests from sessions whose role is Subscriber.
Enforce two-factor authentication and strong password policies on all WordPress accounts to reduce Subscriber account compromise.

bash

# Configuration example: disable open registration and lock default role via wp-config and WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate automatorwp
wp plugin update automatorwp