Is CVE-2026-104768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104768 being exploited in the wild.

How severe is CVE-2026-104768?

High severity, with a CVSS score of 7.5, published 7 November 2026.

Which products and versions are affected?

AutomatorWP – No-Code Workflow Automation, Integration & Webhooks up to and including 6.0.4.

How is CVE-2026-104768 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104768?

Check whether you run AutomatorWP – No-Code Workflow Automation or Integration & Webhooks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104768: AutomatorWP privilege escalation in user creation

CVE-2026-104768 · Severity: high · CVSS 7.5 · Published 2026-11-07

AutomatorWP is a WordPress plugin for building automated workflows without code. An unauthenticated attacker can exploit a flaw in the user creation action to create a new administrator account by approving a specially-crafted comment, gaining full control of a WordPress site. Exploitation requires the site to have an automation rule configured to create users with dynamically-selected roles.

Vendors: AutomatorWP.

Quick answers

Is CVE-2026-104768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104768 being exploited in the wild.
How severe is CVE-2026-104768?: High severity, with a CVSS score of 7.5, published 7 November 2026.
Which products and versions are affected?: AutomatorWP – No-Code Workflow Automation, Integration & Webhooks up to and including 6.0.4.
Is there a fix for CVE-2026-104768?: No fixed version is recorded yet. Disable anonymous automations that use the Role option with dynamic trigger tags such as {comment_author}, or restrict comment approval actions until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104768 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104768?: Check whether you run AutomatorWP – No-Code Workflow Automation or Integration & Webhooks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable anonymous automations that use the Role option with dynamic trigger tags such as {comment_author}, or restrict comment approval actions until a patch is available.

Technical details

The vulnerability is a privilege escalation in the create_user() function due to missing privilege-ceiling validation. When creating users via automation actions (anonymous-user, Create User, or Add/Change Role), the plugin validates that a submitted role exists using automatorwp_get_editable_roles() but fails to verify that the role does not exceed the acting context's privilege level. An unauthenticated attacker can supply arbitrary roles including "administrator" via trigger tag data (e.g., {comment_author}), allowing account creation and password delivery to an attacker-controlled email.

Affected products

AutomatorWP AutomatorWP – No-Code Workflow Automation, Integration & Webhooks up to and including 6.0.4

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.