Advisory · CVE-2026-126173
Unauthenticated password reset in AutomatorWP Pro webhooks can take over any account
AutomatorWP Pro's webhook addon up to version 1.4.4 lets unauthenticated attackers reset any WordPress account password, including administrators, when a specific webhook automation is configured.
- Vendor
- AutomatorWP
- Product
- AutomatorWP Pro (Webhooks addon)
- Identifier / CWE
- CVE-2026-126173
CWE-862 - Action timing
- Immediate
Explain it like I’m five
AutomatorWP lets a website run automatic jobs when it receives a web message. One supported setup lets that message change a user's password without checking who sent it. Anyone on the internet can send the message and take over any account, including the site owner.
- 01Automation configured
An administrator pairs a Receive Webhook trigger, with an 'Is the user ID' field, to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag.
- 02Attacker sends a webhook
An unauthenticated attacker sends a crafted request to the webhook endpoint, supplying a target user ID and a new password.
- 03No authorization check
The addon does not verify that the sender is authorized to perform the action, so the request is accepted.
- 04Password reset
The target account's password is changed to the attacker-chosen value, giving full account takeover, including administrator accounts.
What happened
The AutomatorWP Pro plugin for WordPress’ webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. The plugin does not properly verify that a user is authorized to perform an action, so unauthenticated attackers can reset the password of any WordPress account, including administrators, resulting in full account takeover.
The flaw is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger, with an “Is the user ID” field, to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag. That is a documented, supported plugin configuration.
The vulnerability is rated critical at CVSS 9.8. At the time of publication, no patched version has been announced.
What to do
- Find any automation that pairs a Receive Webhook trigger to an Update-User action with a blank User ID field and a password mapped to the webhook password tag, and disable or reconfigure it.
- If the automation is needed, restrict who can reach the webhook endpoint until a fix is available.
- Watch the vendor for an updated webhook addon release addressing this issue and upgrade as soon as one is published.
- Review administrator and other privileged accounts for unexpected password changes or logins.
- Reset passwords and active sessions for any account that may have been affected.
Management note
This is a critical, unauthenticated path to full administrator takeover on WordPress sites running a supported AutomatorWP Pro configuration, and there is no patch yet. The immediate fix is configuration, not code: remove the vulnerable automation pattern now and treat any site that had it enabled as potentially compromised until its accounts are reviewed.