AutomatorWP Pro Webhook Flaw: Critical Account Takeover

What CVE-2026-126173 is and who is affectedA critical authorization bypass has been published in the NVD of the NIST as CVE-2026-126173. The flaw sits...

What CVE-2026-126173 is and who is affected

A critical authorization bypass has been published in the NVD of the NIST as CVE-2026-126173. The flaw sits in the webhook addon of AutomatorWP Pro, a WordPress automation plugin, and affects all versions up to and including 1.4.4. The weakness is classified as CWE-862 (missing authorization): the plugin does not properly verify that a user is authorised to perform an action.

In practice, an unauthenticated attacker can reset the password of any WordPress account, including administrator accounts, and take full control of the site. The CVSS 3.1 score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects a remotely exploitable issue with no privileges or user interaction required.

The exposure is not universal. According to the NVD description, exploitation requires a specific configuration that an administrator must have set up: an automation pairing a Receive Webhook trigger that includes an 'Is the user ID' field with an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag. That is a documented, supported plugin configuration, so sites using AutomatorWP Pro webhooks should not assume they are out of scope. The vulnerability was published on 14 November 2026.

Why it matters for Spanish SMEs and online shops

This CVE is not listed in CISA's KEV catalogue, and there is no public evidence that it is being exploited in the wild. That is good news, but it is not a reason to wait. A CVSS 9.8 flaw that allows full account takeover is exactly the kind of issue that attracts automated scanning once details become public. For a pyme, an ecommerce site on PrestaShop or WooCommerce, or a small IT team managing several WordPress installations across Lleida, Barcelona, Tarragona or Girona, a compromised administrator account can mean data theft, defacement, malware injection and a GDPR notification obligation.

The configuration dependency also cuts both ways: many sites will not match the exact automation described, but those that do may not know it. Plugin stacks grow over time, and a webhook automation set up months ago by a marketing or operations team is easy to forget.

What to do today

Check whether AutomatorWP Pro is installed and confirm the version. Any installation at or below 1.4.4 is in scope.
Review your automations for a Receive Webhook trigger with an 'Is the user ID' field connected to an Update-User action with a blank User ID and the password mapped to the webhook password tag. If that combination exists, disable it until the plugin is updated.
Apply the fix indicated in the vendor's advisory. The NVD entry does not state a corrected version, so follow the official guidance published by AutomatorWP rather than assuming a specific release resolves it.
Look for signs of intrusion: unexpected password resets, new administrator accounts, unfamiliar plugins or scheduled tasks, and unusual outbound connections from the server.
Reduce what is exposed to the internet. Restrict access to webhook endpoints where possible, keep WordPress, themes and plugins updated, and enforce strong administrator passwords with multi-factor authentication.

How ALMC's cybersecurity team can help

Stories like this one rarely stay isolated. Most compromised WordPress, PrestaShop and Joomla sites we see in Catalonia are the result of an unpatched plugin, a forgotten endpoint or a configuration nobody reviewed. ALMC's cybersecurity service for companies covers security audits and pentesting to find these gaps before attackers do, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations. If a site has already been hacked, we also handle cleanup and recovery. For a small IT team, having that layer of review and response in place is often the difference between a routine patch and a very bad week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.