# AutomatorWP <= 6.0.6 - Missing Authorization to Unauthenticated Zoom Integration OAuth Token Overwrite

- **ID:** WPSEC-2026-2485
- **Plugin:** AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI (`automatorwp`), https://wordpress.org/plugins/automatorwp/
- **Affected versions:** all versions before 6.0.7
- **Fixed in:** 6.0.7 (Update to 6.0.7 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/automatorwp
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2485/

## Description

The AutomatorWP plugin for WordPress is vulnerable to unauthorized modification of data via the Zoom OAuth authorization callback in all versions up to, and including, 6.0.6, due to a missing capability check on the automatorwp_zoom_maybe_authorize_complete function. The function is hooked to admin_init, which also runs for logged-out requests to admin-post.php and admin-ajax.php. This makes it possible for unauthenticated attackers to make the site exchange an OAuth authorization code they supply for the configured Zoom app and save the resulting access and refresh tokens. The site's Zoom integration is then connected to an account the attacker controls.

## References

- https://wpsec.com/vuln/WPSEC-2026-2485/
- https://plugins.svn.wordpress.org/automatorwp/tags/6.0.7/
- https://wordpress.org/plugins/automatorwp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2485/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.