Is CVE-2026-76057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76057 being exploited in the wild.

How severe is CVE-2026-76057?

Medium severity, with a CVSS score of 4.3, published 22 August 2026.

Is there a fix for CVE-2026-76057?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76057 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76057?

Check whether you run AutomatorWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76057: AutomatorWP authorization bypass in ConvertKit integration

CVE-2026-76057 · Severity: medium · CVSS 4.3 · Published 2026-08-22

AutomatorWP is a WordPress plugin that automates workflows and manages third-party integrations like ConvertKit. A flaw in the plugin's authorization checks allows subscriber-level users to access and retrieve sensitive ConvertKit form configuration data—including API credentials and integration details—that should only be visible to administrators. An attacker with a basic WordPress account can exploit this to steal integration secrets and potentially compromise connected services.

Technologies: AutomatorWP. Vendors: AutomatorWP.

Quick answers

Is CVE-2026-76057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76057 being exploited in the wild.
How severe is CVE-2026-76057?: Medium severity, with a CVSS score of 4.3, published 22 August 2026.
Which products and versions are affected?: AutomatorWP up to 5.8.4.
Is there a fix for CVE-2026-76057?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76057 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76057?: Check whether you run AutomatorWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the ConvertKit integration AJAX handlers. The plugin fails to properly validate user capabilities before exposing sensitive integration data via AJAX endpoints. The required WordPress nonce is generated and included in the admin page HTML on every pageload, making it accessible to any authenticated user who reaches /wp-admin. An authenticated attacker with subscriber-level access or higher can forge requests using the leaked nonce to call AJAX actions that return all ConvertKit form configuration data, including API tokens and webhook secrets configured by site administrators. This is a direct authorization check failure—the nonce protects against CSRF but does not restrict access based on user role. The vulnerability affects all versions up to and including 5.8.4; patch status is not yet confirmed.

Affected products

AutomatorWP AutomatorWP up to 5.8.4

Timeline

2026-08-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.