CVE-2026-121472
AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
| Vendor | unknown |
| Product | automatorwp |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown automatorwp
Be the first to know when new unknown vulnerabilities affecting unknown automatorwp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / AutomatorWP
0 < 6.0.8
References
Credits
kta1kri WPScan