SecAlerts
A

AutomatorWP

Security Risk Profile

41
/100
medium

Security Risk Score

Comprehensive risk assessment based on 13 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from November 1, 2021 to present

13
Total CVEs
6
Critical+High
0
Exploited
6
Unpatched

Threat Assessment

Avg CVSS
6.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
41/100
medium
🆕 3Fresh (<7d)📈 3 in Last 30 Days

Severity Distribution

Critical
1
High
5
Medium
7
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
3

Age Distribution

Common Weaknesses (CWE)

1
CSRF
2
2
Code Injection
1
3
SQL Injection
1
4
XSS
1

Most Affected Products

1. AutomatorWP AutomatorWP5
2. AutomatorWP AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress2
3. AutomatorWP Automator2
4. AutomatorWP AutomatorWP WordPress2
5. AutomatorWP AutomatorWP WordPress plugin1

Recent Vulnerabilities

See more →
CVE-2026-121472
CVSS 5.0medium

AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF

Nov 11, 2026🔧 No Patch
CVE-2026-104768
CVSS 7.5high

AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

Nov 7, 2026🔧 No Patch
CVE-2026-118239
CVSS 5.6medium

AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

Nov 6, 2026🔧 No Patch
CVE-2026-104728
CVSS 4.3medium

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action

Oct 10, 2026🔧 No Patch
CVE-2026-76074
CVSS 4.3medium

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action

Aug 22, 2026🔧 No Patch
CVE-2026-76057
CVSS 4.3medium

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action

Aug 22, 2026🔧 No Patch
CVE-2026-40785
CVSS 7.1high

WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability

Jun 15, 2026🔧 No Patch
CVE-2025-9539
CVSS 8.0EPSS 0%high

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation

Sep 9, 2025🔧 No Patch
CVE-2025-9542
CVSS 5.4EPSS 0%medium

AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions

Sep 9, 2025🔧 No Patch
CVE-2025-5487
CVSS 7.2EPSS 0%high

AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions

Jun 14, 2025🔧 No Patch

Monitor AutomatorWP in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.