{
 "id": "WPSEC-2026-2486",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2486/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2486/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2486/index.md",
 "title": "AutomatorWP <= 6.0.6 - Missing Authorization to Unauthenticated AWeber Integration OAuth Token Overwrite",
 "description": "The AutomatorWP plugin for WordPress is vulnerable to unauthorized modification of data via the AWeber OAuth authorization callback in versions 5.4.9 up to, and including, 6.0.6, due to a missing capability check on the automatorwp_aweber_maybe_authorize_complete function. The function is hooked to admin_init, which also runs for logged-out requests to admin-post.php and admin-ajax.php. This makes it possible for unauthenticated attackers to make the site exchange an OAuth authorization code they supply for the configured AWeber app and save the resulting tokens. The site's AWeber integration credentials are then replaced with tokens for an account the attacker controls.",
 "plugin": {
  "slug": "automatorwp",
  "name": "AutomatorWP",
  "full_name": "AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI",
  "wordpress_org": "https://wordpress.org/plugins/automatorwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/automatorwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/automatorwp"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.4.9",
    "from_inclusive": true,
    "to": "6.0.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.4.9 before 6.0.7"
  ]
 },
 "introduced_in": "5.4.9",
 "fixed_in": "6.0.7",
 "remediation": "Update to 6.0.7 or later.",
 "fix_released": "2026-11-03T12:17:52+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:58:47.566678+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2486/",
  "https://plugins.svn.wordpress.org/automatorwp/tags/6.0.7/",
  "https://wordpress.org/plugins/automatorwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/automatorwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}