01 Record

CVE-2026-76057

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action

MediumPUBLISHEDCNA: Wordfence

Base score4.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

View raw JSON CVE Program record

02 Description

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action

03 Metadata

Published

2026-08-22 03:37Z1 HR AGO

Last updated

2026-08-22 03:37Z1 HR AGO

Reserved

2026-08-18

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

Medium (CVSS 4.3)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862Missing AuthorizationClass

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

b67e05c152999fae66a76b3186b1aa3fbdd1ab6c6514eadc49daf573c19eff11

04 Affected products

VendorProductVersionsPlatforms

rubengcAutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress0 to 5.8.4—

05 References

www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/b0fd8e7b-1985-4265-8e15-5b3988bb0225?source=cve
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/convertkit/includes/ajax-functions.php#L66
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/convertkit/includes/ajax-functions.php#L96
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/includes/scripts.php#L161
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/convertkit/includes/ajax-functions.php#L16
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?reponame=&old=3656285%40automatorwp&new=3656285%40automatorwp