CVE-2026-121472: AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF
The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to credential replacement?
Sites using AutomatorWP versions before 6.0.8 are exposed if they have an existing Zoom or AWeber integration connection. The attacker also needs to know the site's OAuth client identifier.
What access does an attacker need to exploit this?
The attacker must be able to induce a logged-in administrator to complete the CSRF flow. The description does not indicate that the attacker needs an account on the WordPress site.
What is the impact if exploitation succeeds?
The stored Zoom or AWeber integration credentials can be replaced with credentials controlled by the attacker. Data the site sends through the affected integration can then be diverted to the attacker's account.
How can I determine whether my site is potentially affected?
Check whether AutomatorWP is below version 6.0.8 and whether Zoom or AWeber is already connected in the plugin. Both conditions are required for the described attack.