01 Record

CVE-2026-76074

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action

MediumPUBLISHEDCNA: Wordfence

Base score4.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

View raw JSON CVE Program record

02 Description

AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action

03 Metadata

Published

2026-08-22 03:37Z1 HR AGO

Last updated

2026-08-22 03:37Z1 HR AGO

Reserved

2026-08-18

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

Medium (CVSS 4.3)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862Missing AuthorizationClass

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

a8bb4909f37f0fb28482099afebcde2359431d328ee1cec4a603cdd0750ea3cc

04 Affected products

VendorProductVersionsPlatforms

rubengcAutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress0 to 5.8.4—

05 References

www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/daac833f-b350-453a-b56a-fe3b1dd2ed3b?source=cve
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/campaign-monitor/includes/ajax-functions.php#L89
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/campaign-monitor/includes/ajax-functions.php#L124
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/includes/scripts.php#L161
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?reponame=&old=3656285%40automatorwp&new=3656285%40automatorwp