# CVE-2026-104768: AutomatorWP privilege escalation in user creation

Source: https://junglewise.ai/threats/cve-2026-104768-the-automatorwp-no-code-workflow-automation-integration-webhooks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-104768 · Severity: high · CVSS 7.5 · Published 2026-11-07

AutomatorWP is a WordPress plugin for building automated workflows without code. An unauthenticated attacker can exploit a flaw in the user creation action to create a new administrator account by approving a specially-crafted comment, gaining full control of a WordPress site. Exploitation requires the site to have an automation rule configured to create users with dynamically-selected roles.

Vendors: [AutomatorWP](https://junglewise.ai/threats/vendors/automatorwp).

## Quick answers

**Is CVE-2026-104768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104768 being exploited in the wild.

**How severe is CVE-2026-104768?** High severity, with a CVSS score of 7.5, published 7 November 2026.

**Which products and versions are affected?** AutomatorWP – No-Code Workflow Automation, Integration & Webhooks up to and including 6.0.4.

**Is there a fix for CVE-2026-104768?** No fixed version is recorded yet. Disable anonymous automations that use the Role option with dynamic trigger tags such as {comment_author}, or restrict comment approval actions until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104768?** Check whether you run AutomatorWP – No-Code Workflow Automation or Integration & Webhooks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable anonymous automations that use the Role option with dynamic trigger tags such as {comment_author}, or restrict comment approval actions until a patch is available.

## Technical details

The vulnerability is a privilege escalation in the create_user() function due to missing privilege-ceiling validation. When creating users via automation actions (anonymous-user, Create User, or Add/Change Role), the plugin validates that a submitted role exists using automatorwp_get_editable_roles() but fails to verify that the role does not exceed the acting context's privilege level. An unauthenticated attacker can supply arbitrary roles including "administrator" via trigger tag data (e.g., {comment_author}), allowing account creation and password delivery to an attacker-controlled email.

## Affected products

- AutomatorWP AutomatorWP – No-Code Workflow Automation, Integration & Webhooks up to and including 6.0.4

## Timeline

- 2026-11-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/events.php](https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/events.php)
- [https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php](https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actions/anonymous-user.php)