AutomatorWP Pro Webhooks Flaw Puts Configured Admin Accounts at Risk

AutomatorWP Webhooks CVE-2026-126173 affects the Pro Webhooks add-on through version 1.4.4 when a specific automation is configured. Patchstack lists 1.4.5 as the patched release. Site owners should update the add-on and check whether the affected workflow exists before assessing account exposure.

Wordfence’s 14 November CNA record describes missing authorization that can let an unauthenticated person reset a WordPress account password, including an administrator’s. The condition depends on a supported pairing of a Receive Webhook trigger and an Update-User action. It does not describe every AutomatorWP or WordPress installation.

AutomatorWP Webhooks CVE-2026-126173: Affected Setup and Fix

The CNA record identifies the necessary configuration: the webhook trigger uses an “Is the user ID” field. Its paired Update-User action has a blank User ID field and maps the Password field to the webhook password tag. Teams should compare these settings with their actual automations, without circulating webhook values or account details.

The missing check is authorization for the requested user action, according to Wordfence’s CNA description. In that configuration, the action could change a selected account’s password without the account owner’s authorization. The record assigns CVSS 3.1 a 9.8 Critical score and CWE-862. It provides no CVSS 4.0 score.

Patch the Add-on, Then Verify the Workflow

Start with an inventory of sites using the Pro Webhooks add-on and record each installed version. Compare each Receive Webhook to Update-User automation with the CNA condition before assigning priority. The vulnerability intelligence platform can help teams keep that exposure decision tied to remediation work.

• Identify installationsConfirm whether the Pro Webhooks add-on is installed and note its version.
• Review automationsFind the named trigger and action pairing, then inspect the user ID and password mapping.
• Apply the fixUpdate affected add-on installations to 1.4.5 or later, as Patchstack advises.
• Verify and reviewConfirm the running version, retest authorized behavior, and review relevant administrator password changes.

If updating needs a maintenance window, restrict access to the exposed workflow while preparing the patch. This is our containment recommendation based on the CNA’s configuration requirement. Record the final add-on version and workflow review in the patch management process. Review administrator access and password reset records if the vulnerable configuration was present.

What the Current Risk Evidence Means

Patchstack’s 13 November entry says it expects this vulnerability to become exploited. That is a forecast, not a confirmed attack report. The CISA KEV catalog version dated 13 November does not list CVE-2026-126173. Neither point replaces the local configuration and version check.

For the lasting flaw definition, use the planned CVE profile once it is live; this dated alert focuses on today’s patch decision.

Owners who need more background on prioritizing a version and configuration together can consult the vulnerability intelligence overview. The source of the affected workflow is the Wordfence CNA record. The fixed version comes from Patchstack’s vulnerability entry.