Skip to content
Sign in
5.6 Medium

CVE-2026-118239 AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

Description

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Affected products and versions

Product Affected versions Fixed in
AutomatorWP 6.0 earliest → < 6.0.7 6.0.7

Other CVEs of AutomatorWP

The 2 CVEs of AutomatorWP →
CVE-2021-24717 The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber… Not rated
Track this CVE