# CVE-2026-76057: AutomatorWP authorization bypass in ConvertKit integration

Source: https://junglewise.ai/threats/cve-2026-76057-automatorwp-authorization-bypass-in-convertkit-integration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76057 · Severity: medium · CVSS 4.3 · Published 2026-08-22

AutomatorWP is a WordPress plugin that automates workflows and manages third-party integrations like ConvertKit. A flaw in the plugin's authorization checks allows subscriber-level users to access and retrieve sensitive ConvertKit form configuration data—including API credentials and integration details—that should only be visible to administrators. An attacker with a basic WordPress account can exploit this to steal integration secrets and potentially compromise connected services.

Technologies: [AutomatorWP](https://junglewise.ai/threats/technologies/automatorwp). Vendors: [AutomatorWP](https://junglewise.ai/threats/vendors/automatorwp).

## Quick answers

**Is CVE-2026-76057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76057 being exploited in the wild.

**How severe is CVE-2026-76057?** Medium severity, with a CVSS score of 4.3, published 22 August 2026.

**Which products and versions are affected?** AutomatorWP up to 5.8.4.

**Is there a fix for CVE-2026-76057?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76057 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76057?** Check whether you run AutomatorWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-639) in the ConvertKit integration AJAX handlers. The plugin fails to properly validate user capabilities before exposing sensitive integration data via AJAX endpoints. The required WordPress nonce is generated and included in the admin page HTML on every pageload, making it accessible to any authenticated user who reaches /wp-admin. An authenticated attacker with subscriber-level access or higher can forge requests using the leaked nonce to call AJAX actions that return all ConvertKit form configuration data, including API tokens and webhook secrets configured by site administrators. This is a direct authorization check failure—the nonce protects against CSRF but does not restrict access based on user role. The vulnerability affects all versions up to and including 5.8.4; patch status is not yet confirmed.

## Affected products

- AutomatorWP AutomatorWP up to 5.8.4

## Timeline

- 2026-08-22: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/includes/scripts.php](https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/includes/scripts.php)
- [https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/convertkit/includes/ajax-functions.php](https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.8.4/integrations/convertkit/includes/ajax-functions.php)

## Related threats

- [AutomatorWP WordPress plugin CSRF in Zoom/AWeber integration](https://junglewise.ai/threats/cve-2026-121472-the-automatorwp-wordpress-plugin-before-6-0-8-does-not-bind-the)
- [AutomatorWP WordPress plugin OAuth callback authorization bypass](https://junglewise.ai/threats/cve-2026-118239-the-automatorwp-wordpress-plugin-before-6-0-7-does-not-check)
- [AutomatorWP authorization bypass in Fluent Forms integration](https://junglewise.ai/threats/cve-2026-104728-the-automatorwp-no-code-workflow-automation-integration-webhooks)
- [AutomatorWP broken access control in subscriber functions](https://junglewise.ai/threats/cve-2026-78266-automatorwp-broken-access-control-in-subscriber-functions)
- [AutomatorWP authorization bypass in Campaign Monitor integration](https://junglewise.ai/threats/cve-2026-76074-automatorwp-authorization-bypass-in-campaign-monitor-integration)