CVE-2026-126173 is a critical (CVSS 9.8) authorization bypass in the AutomatorWP Pro webhook addon for WordPress, versions up to and including 1.4.4. In one specific automation setup, an unauthenticated attacker can reset the password of any account, including administrators.
What Is It
CVE-2026-126173 is a missing authorization flaw (CWE-862) in the webhook addon of the AutomatorWP Pro plugin for WordPress. According to the NVD description, the plugin does not properly verify that a user is authorized to perform an action. An unauthenticated attacker can use this to reset the password of any WordPress account, including administrator accounts, and take it over.
The flaw is only exploitable in one configuration. An administrator must have set up an automation that pairs:
- a Receive Webhook trigger with an "Is the user ID" field, and
- an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag.
The NVD description notes that this is a documented, supported plugin configuration.
Wordfence reported the issue, and NVD published it on 2026-11-14. NVD currently lists the record as "Deferred."
Why It Matters
Wordfence scores this CVSS 3.1 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- It can be attacked over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- The impact on confidentiality, integrity and availability is high.
Resetting an administrator's password gives the attacker full control of the WordPress site.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so the supplied data does not confirm active exploitation.
What's Vulnerable
- Vendor: AutomatorWP
- Product: AutomatorWP Webhooks, the webhook addon for AutomatorWP Pro
- Affected versions: all versions up to and including 1.4.4
- Required condition: the Receive Webhook → Update-User automation described above
Sites running an affected version without that automation are not exploitable according to the NVD description.
Patch Status
The supplied NVD record does not name a fixed version, and there is no CISA KEV entry with a required action or due date. Administrators should:
- check the vendor and Wordfence advisories for an updated release of the webhook addon;
- review existing automations for the Receive Webhook → Update-User pattern, especially Update-User actions with a blank User ID field and a Password field mapped to the webhook password tag.