Executive brief
AutomatorWP is a WordPress plugin that enables no-code automations and integrations. The plugin fails to properly restrict access to Campaign Monitor mailing list configuration, allowing any authenticated user (even with basic subscriber access) to retrieve sensitive mailing list IDs and names that should only be visible to administrators. An attacker can exploit an unconditionally exposed security token to gain unauthorized access to this restricted data.
Technical details
The vulnerability is an authorization bypass in the Campaign Monitor integration component of AutomatorWP. The root cause is improper authorization checks on AJAX endpoints that retrieve Campaign Monitor list catalogs; the plugin fails to verify that the requesting user has the required manager capability. Additionally, the nonce (security token) used to protect these endpoints is emitted unconditionally via wp_localize_script on every WordPress admin page, allowing any subscriber-level user visiting /wp-admin/profile.php to obtain it. An authenticated attacker with subscriber-level access can then use the exposed nonce to make unauthorized AJAX requests and retrieve all configured Campaign Monitor mailing list IDs and names. The vulnerability affects all versions up to and including 5.8.4; patches should be available in later releases.
Affected products
- AutomatorWP AutomatorWP up to and including 5.8.4
Timeline
- 2026-08-22: disclosed