Wordfence's CNA record says an unauthenticated attacker can reset a WordPress account password, including an administrator's, when a specific automation is configured.Versions through 1.4.4 are affected, and Patchstack lists 1.4.5 as the patched version. The flaw does not make every AutomatorWP installation exploitable; the stated automation condition matters.
What it allows
How Can CVE-2026-126173 Lead to Account Takeover?
The Wordfence CNA record identifies a missing authorization check, classified as CWE-862. The exposed workflow pairs a Receive Webhook trigger using the ‘Is the user ID’ field with an Update User action.
In that action, the User ID field is blank and the Password field uses the webhook password tag. Under those conditions, the record says an unauthenticated party can reset any WordPress user's password, including an administrator's, and take over the account.
The CNA assigns CVSS 3.1 9.8, Critical, with network access and no required privileges or user interaction. This score describes potential impact; it does not establish an observed attack.
Brandefense Blackhole counted two dark-chat posts matching this CVE from 16 August through 14 November 2026. This is a count of discussion posts, not confirmed exploitation or affected sites. The 13 November CISA KEV catalog snapshot does not list this CVE.
Track the condition and patch status in a vulnerability intelligence platform workflow.
Who is affected
Which AutomatorWP Webhooks Versions and Automations Are Affected?
The CNA lists AutomatorWP Webhooks versions 1.4.4 and earlier. Patchstack identifies 1.4.5 as the version that fixes this flaw. The affected component is the Pro Webhooks add-on, not every WordPress site or every AutomatorWP installation.
Review enabled automations for the CNA's precise pairing. It uses Receive Webhook with ‘Is the user ID’, then Update User with an empty User ID and a Password mapped to the webhook password tag. Check this configuration alongside the installed add-on version.
Compare the installed add-on version with 1.4.5 and verify the running version after updating. The CNA's lower bound is the broad value ‘0’, so this profile uses a manual comparison instead of a machine-readable version range. For account impact and response concepts, see the account takeover explainer.
Timeline
- 2026-11-13
The CNA timeline records disclosure; Patchstack published its advisory and listed 1.4.5 as fixed.
- 2026-11-14
Wordfence published the CVE-2026-126173 CNA record.
What to do
-
Inventory the add-on and matching automation
Find sites using AutomatorWP Pro Webhooks through 1.4.4. Inspect enabled Receive Webhook to Update User automations for the CNA's exact field mapping, and prioritize sites with that pairing.
-
Update the add-on to 1.4.5 or later
Apply the Patchstack-listed fixed version. If updating must wait, disable the matching password-changing automation as a temporary defensive measure; test the effect on the intended workflow.
-
Confirm the installed version and review accounts
After maintenance, verify that the running Pro Webhooks add-on reports 1.4.5 or later and recheck the automation. As Brandefense defensive guidance, investigate unexpected account password changes and administrator sessions on exposed sites.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does CVE-2026-126173 affect every AutomatorWP installation?
The CNA names the Pro Webhooks add-on through 1.4.4 and a specific Receive Webhook to Update User automation. Check both the installed version and that configuration.
Can the flaw reset an administrator password?
Wordfence's CNA record says the stated automation can let an unauthenticated attacker reset any WordPress account password, including an administrator's.
What version fixes CVE-2026-126173?
Patchstack lists AutomatorWP Pro Webhooks 1.4.5 as patched. Update to 1.4.5 or later and verify the version running on each affected site.
Do the Blackhole posts prove exploitation?
No. Brandefense Blackhole counted two matching dark-chat posts during 16 August to 14 November 2026; discussion volume does not establish a successful attack.
Sources
- CVE-2026-126173 CNA RecordWordfence via CVE Program
- AutomatorWP Pro Webhooks VulnerabilityPatchstack
- CVE-2026-126173 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCISA
