{
 "id": "WPSEC-2026-2573",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2573/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2573/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2573/index.md",
 "title": "AutomatorWP <= 6.0.7 - Cross-Site Request Forgery via AWeber OAuth Callback",
 "description": "The AutomatorWP plugin for WordPress is vulnerable to Cross-Site Request Forgery via the AWeber OAuth authorization callback in all versions up to, and including, 6.0.7, due to missing validation of the OAuth 'state' parameter in the automatorwp_aweber_maybe_authorize_complete() function before an authorization code is exchanged for tokens. This makes it possible for unauthenticated attackers who hold an authorization code issued for the site's AWeber app to link the site's AWeber integration to an AWeber account they control via a forged request, granted they can trick a site administrator into clicking a crafted callback link.",
 "plugin": {
  "slug": "automatorwp",
  "name": "AutomatorWP",
  "full_name": "AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI",
  "wordpress_org": "https://wordpress.org/plugins/automatorwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/automatorwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/automatorwp"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.4.9",
    "from_inclusive": true,
    "to": "6.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.4.9 before 6.0.8"
  ]
 },
 "introduced_in": "5.4.9",
 "fixed_in": "6.0.8",
 "remediation": "Update to 6.0.8 or later.",
 "fix_released": "2026-11-04T10:52:45+00:00",
 "published": "2026-11-05T11:43:51+00:00",
 "updated": "2026-11-04T13:58:44.430393+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2573/",
  "https://plugins.svn.wordpress.org/automatorwp/tags/6.0.8/",
  "https://wordpress.org/plugins/automatorwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/automatorwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}