Executive brief
AutomatorWP is a WordPress plugin that automates workflows and manages third-party integrations like ConvertKit. A flaw in the plugin's authorization checks allows subscriber-level users to access and retrieve sensitive ConvertKit form configuration data—including API credentials and integration details—that should only be visible to administrators. An attacker with a basic WordPress account can exploit this to steal integration secrets and potentially compromise connected services.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the ConvertKit integration AJAX handlers. The plugin fails to properly validate user capabilities before exposing sensitive integration data via AJAX endpoints. The required WordPress nonce is generated and included in the admin page HTML on every pageload, making it accessible to any authenticated user who reaches /wp-admin. An authenticated attacker with subscriber-level access or higher can forge requests using the leaked nonce to call AJAX actions that return all ConvertKit form configuration data, including API tokens and webhook secrets configured by site administrators. This is a direct authorization check failure—the nonce protects against CSRF but does not restrict access based on user role. The vulnerability affects all versions up to and including 5.8.4; patch status is not yet confirmed.
Affected products
- AutomatorWP AutomatorWP up to 5.8.4
Timeline
- 2026-08-22: disclosed