CVE-2026-76057: AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all ConvertKit form data configured by the site's manager account, exposing integration details intended to be restricted to plugin managers. The required nonce is localized on every admin page load, making it accessible to any authenticated user who can reach /wp-admin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AutomatorWP (WordPress plugin)to a version that resolves this vulnerability.Fixed in 5.8.4 - Compensating control
Restrict access to /wp-admin so that only trusted administrators/managers can reach it, since the required nonce is localized on every admin page load and becomes accessible to any authenticated user who can reach /wp-admin.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it, provided they can access /wp-admin. No interaction from a higher-privileged user is required.
What information can be exposed?
An attacker can retrieve all ConvertKit form data configured through the site manager's account. This can expose ConvertKit integration details that are intended to be limited to plugin managers.
Does exploitation require a separate nonce disclosure or special configuration?
The AJAX action requires a nonce, but the nonce is localized on every WordPress admin-page load. Therefore, any authenticated user able to reach /wp-admin can obtain the required nonce.
How can I determine whether my site is affected?
Sites using the AutomatorWP plugin at version 5.8.4 or earlier are affected when ConvertKit form data is configured through the plugin. Review whether untrusted Subscriber or higher accounts exist that can access the WordPress admin area.