{
 "id": "WPSEC-2026-2574",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2574/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2574/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2574/index.md",
 "title": "AutomatorWP <= 6.0.7 - Cross-Site Request Forgery via Zoom OAuth Callback",
 "description": "The AutomatorWP plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Zoom OAuth authorization callback in all versions up to, and including, 6.0.7, due to the automatorwp_zoom_maybe_authorize_complete() function using the 'state' parameter only to pick the platform, with no nonce check, before an authorization code is exchanged for tokens. This makes it possible for unauthenticated attackers who hold an authorization code issued for the site's Zoom app to link the site's Zoom integration to a Zoom account they control via a forged request, granted they can trick a site administrator into clicking a crafted callback link.",
 "plugin": {
  "slug": "automatorwp",
  "name": "AutomatorWP",
  "full_name": "AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI",
  "wordpress_org": "https://wordpress.org/plugins/automatorwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/automatorwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/automatorwp"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.0.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.0.8",
 "remediation": "Update to 6.0.8 or later.",
 "fix_released": "2026-11-04T10:52:45+00:00",
 "published": "2026-11-05T11:43:51+00:00",
 "updated": "2026-11-04T13:58:44.430393+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2574/",
  "https://plugins.svn.wordpress.org/automatorwp/tags/6.0.8/",
  "https://wordpress.org/plugins/automatorwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/automatorwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}