CVE-2026-126173: AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to unauthenticated account takeover?
Exposure requires a configured automation that pairs a Receive Webhook trigger containing an 'Is the user ID' field with an Update-User action. The Update-User action must have its User ID field blank and its Password field mapped to the webhook password tag.
Does an attacker need a WordPress account or other privileges?
No. The issue can be exploited by an unauthenticated attacker when the affected webhook automation configuration is present.
What accounts can be taken over?
An attacker can reset the password of any WordPress account, including administrator accounts, through the vulnerable automation configuration.
What can be done while patching is not available?
Review webhook automations and disable or modify any matching configuration. In particular, avoid Receive Webhook triggers using 'Is the user ID' together with an Update-User action that has a blank User ID and maps the Password field to the webhook password tag.
How can I determine whether my site is affected?
Check whether the AutomatorWP Pro webhook addon version is 1.4.4 or earlier, then inspect configured automations for the specific trigger and Update-User field combination described. A vulnerable version alone is not sufficient for exploitation without that configuration.