Is CVE-2026-76074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76074 being exploited in the wild.

How severe is CVE-2026-76074?

Medium severity, with a CVSS score of 4.3, published 22 August 2026.

Which products and versions are affected?

AutomatorWP up to and including 5.8.4.

Is there a fix for CVE-2026-76074?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76074 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76074?

Check whether you run AutomatorWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76074: AutomatorWP authorization bypass in Campaign Monitor integration

CVE-2026-76074 · Severity: medium · CVSS 4.3 · Published 2026-08-22

AutomatorWP is a WordPress plugin that enables no-code automations and integrations. The plugin fails to properly restrict access to Campaign Monitor mailing list configuration, allowing any authenticated user (even with basic subscriber access) to retrieve sensitive mailing list IDs and names that should only be visible to administrators. An attacker can exploit an unconditionally exposed security token to gain unauthorized access to this restricted data.

Technologies: AutomatorWP. Vendors: AutomatorWP.

Quick answers

Is CVE-2026-76074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76074 being exploited in the wild.
How severe is CVE-2026-76074?: Medium severity, with a CVSS score of 4.3, published 22 August 2026.
Which products and versions are affected?: AutomatorWP up to and including 5.8.4.
Is there a fix for CVE-2026-76074?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76074 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76074?: Check whether you run AutomatorWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the Campaign Monitor integration component of AutomatorWP. The root cause is improper authorization checks on AJAX endpoints that retrieve Campaign Monitor list catalogs; the plugin fails to verify that the requesting user has the required manager capability. Additionally, the nonce (security token) used to protect these endpoints is emitted unconditionally via wp_localize_script on every WordPress admin page, allowing any subscriber-level user visiting /wp-admin/profile.php to obtain it. An authenticated attacker with subscriber-level access can then use the exposed nonce to make unauthorized AJAX requests and retrieve all configured Campaign Monitor mailing list IDs and names. The vulnerability affects all versions up to and including 5.8.4; patches should be available in later releases.

Affected products

AutomatorWP AutomatorWP up to and including 5.8.4

Timeline

2026-08-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.