CVE-2025-9539: AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwpajaximportautomationfromurl function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9539?
CVE-2025-9539 has a high severity due to the potential for unauthorized modification of data.
How do I fix CVE-2025-9539?
To fix CVE-2025-9539, update the AutomatorWP – Automator plugin to version 5.3.7 or later.
Who is affected by CVE-2025-9539?
Users of the AutomatorWP – Automator plugin in WordPress versions up to and including 5.3.6 are affected by CVE-2025-9539.
What is the main issue with CVE-2025-9539?
The main issue with CVE-2025-9539 is the missing capability check on the automatorwp_ajax_import_automation_from_url function.
When was CVE-2025-9539 disclosed?
CVE-2025-9539 was disclosed recently, highlighting its critical vulnerabilities in the AutomatorWP plugin.