AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI

AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 16 are fixed as of October 2026. Their average CVSS score is 5.8, and the most serious one scores 9.6 out of 10. Severity breakdown: 1 critical and 5 high. 2026 was the busiest year with 7 disclosures.

The most common weakness is Missing Authorization, behind 6 of the records (38%). Other recurring categories include Cross-Site Scripting, SQL Injection.

Every one of the 16 issues recorded for AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (3) reported by Wordfence PRISM. AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891031.03.2020Today28.09.20218.8AutomatorWP <= 1.7.5 - Privilege Escalation CVSS 8.8 · 28.09.202120.01.20234.3AutomatorWP <= 2.5.0 - Cross Site Request Forgery CVSS 4.3 · 20.01.202314.02.20234.3AutomatorWP <= 2.5.8 - Cross Site Request Forgery via bulk_delete CVSS 4.3 · 14.02.202318.12.20249.6AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value CVSS 9.6 · 18.12.202419.05.20254.9AutomatorWP <= 5.2.1.3 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 19.05.202513.06.20257.2AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions CVSS 7.2 · 13.06.202519.06.20254.9AutomatorWP <= 5.2.4 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 19.06.202508.09.20258.0AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation CVSS 8.0 · 08.09.20255.4AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions CVSS 5.4 · 08.09.202523.04.20264.3AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Missing Authorization CVSS 4.3 · 23.04.202629.04.20267.2AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 29.04.202603.06.20267.2AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 03.06.202621.08.20264.3AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action CVSS 4.3 · 21.08.20264.3AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action CVSS 4.3 · 21.08.202624.08.20264.3AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI <= 5.8.3 - Missing Authorization CVSS 4.3 · 24.08.202609.10.20264.3AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action CVSS 4.3 · 09.10.2026

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

16

Get automatic notifications for all AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.6CVE-2024-12626

AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value

Read the full analysis

Vulnerability Records

16 records
2026-10-09 19:31CVE-2026-104728
4.3
Medium
Wordfence PRISMYes
2026-08-24 12:59CVE-2026-78266
4.3
Medium
Ugur OzerYes
2026-08-21 15:09CVE-2026-76057
4.3
Medium
Wordfence PRISMYes
2026-08-21 15:03CVE-2026-76074
4.3
Medium
Wordfence PRISMYes
2026-06-03 00:00CVE-2026-42775
7.2
High
darooYes
2026-04-29 00:00CVE-2026-42650
7.2
High
Nguyen Ba KhanhYes
2026-04-23 00:00CVE-2026-40785
4.3
Medium
Jakub HermanYes
2025-09-08 17:53CVE-2025-9539
8.0
High
stealthcopterYes
2025-09-08 17:53CVE-2025-9542
5.4
Medium
stealthcopterYes
2025-06-19 00:00CVE-2025-68561
4.9
Medium
Nguyen Kim SangYes
Showing 1–10 of 16 reports
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI banner
Latestv6.0.5

AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI

Ruben Garcia

Author

Ruben Garcia

4.8(202)
96/100
Last Updated
2026-10-20 (8d ago)
Active Installs
6,000+
Downloads
777,575
Requires WP
4.4+
Requires PHP
7.0+
Tested up to
WP 7.1.3
Created
2020-03-31 (7y ago)

AutomatorWP is a flexible, open-source automator plugin that connects your WordPress plugins, sites and apps together to build powerful workflows with ease. You can create “automations” linked to your WordPress activities and when any of them happen, you can make other things happen accordingly. Automate sales, marketing, administrative tasks, learning experiences and countless other processes to save time, eliminate repetitive work, and focus on what matters most. ⚡ Use automations to connect your plugins Here are some automations samples to give you a quick idea of what you can build: When user purchases a WooCommerce product > Add a WP Fusion tag to the user When user joins a BuddyPress group > Enroll user in a LearnDash course Also, you can combine multiple triggers and actions to build advanced automations like this: When user creates a bbPress topic and completes a H5P content > Enroll user in a LifterLMS course, add to MemberPress membership and email user with the access instructions. The number of combinations and possibilities are unlimited! 🛜 Webhooks to keep your site connected With Webhooks you can send and receive data from anywhere, connecting all your WordPress plugins with platforms like Zapier or Make. Even you can connect your plugins from different sites! Example: User purchases a product on Site A > Enroll user in a course on Site B Anything with support to webhooks or a Rest API can be connected with the Webhooks add-on and, in consequence, with your WordPress plugins! View Webhooks automations samples 🔥 Features Own your data: AutomatorWP works entirely inside your WordPress, not as a SaaS or a credits-based platform with no artificial usage limits. Unlimited triggers and actions: Configure as many triggers and actions per automation as you want. Logged-in and anonymous automations: AutomatorWP can work for both, logged-in users and guest visitors. Scheduled and recurring automations: Automations to run actions on all or on a filtered group of users manually, on a specific date or on a recurring basis. Loop automations: Automations that can loop all or a group of posts or users to process actions on them like remove inactive users or email administrators about pending posts. Filters: Filter any trigger or action with the conditions of your choice. Required number of times: Set the number of times required to complete a trigger like comment on a post 3 times. Sequential triggers: Force users to complete triggers in order to complete the automation. Completion limits: Limit automation’s maximum completion times per user and globally. Tags: To pass dynamic information from triggers to actions (with support to user and post metas). AI Assistant included: Ready to help you design, create and manage your automations, with the addition to execute any action available in AutomatorWP! Developer-friendly: Extremely flexible with plenty of hooks to add custom functionalities. ✨ AI Assistant included! Built-in AI Assistant designed to design, create, and manage automations using natural language. Its features include: 📜 Build automations in seconds: Describe what you want to automate and the Assistant creates the entire automation ready for you to review and activate! Example Prompt: When a user purchases "Product A", add the tag "Customer", award "Badge A" and send a welcome email Note: Yes, for a “welcome email” instruction, the Assistant composes the entire email for you! 🚀 Run actions directly: The Assistant can run any action available in AutomatorWP, giving you thousands of possibilities! In addition, it will log every execution, allowing you see what has been executed, the parameters passed and the action(s) result(s). Example Prompts: Enroll John Doe on "Course A" and award "Badge A" ✏️ Update existing automations: Made to help you save time, the Assistant can update existing automations effortlessly. Example Prompt: Add the actions award 10 points and send welcome email to "Automation A" Note: This assistant uses the WP AI Connectors. Without a configured connector, it won’t be able to perform any tasks. ⚙️ Integrated with +300 WordPress plugins AutomatorWP includes +600 triggers, actions and filters from +300 plugins & platforms for free, including: ActiveMember360 Advanced Ads Advanced Custom Fields (ACF) AffiliatePress AffiliateWP Amelia AnsPress ARForms ARMember Asgaros Forum Autonami Awesome Support BBForms bbPress Better Messages Blockli BookingPress Brizy BuddyBoss BuddyPress Caldera Forms Code Snippets Contact Form 7 Charitable DigiMember Divi Download Manager Easy Affiliate Easy Digital Downloads Elementor Eventin Everest Forms Favorites FluentBooking FluentCart FluentCRM Fluent Support Fluent Forms Formidable Forms Forminator GamiPress GeoDirectory Gravity Forms Gravity Kit Groundhogg H5P HappyForms iMember360 Invite Anyone Jetpack CRM JetEngine JetFormBuilder Kadence Blocks Kali Forms LearnDash LearnPress LifterLMS Mail Mint MailPoet MailerPress Masteriyo LMS MasterStudy LMS MemberPress Meta Box MetForm Modern Events Calendar MyCred Newsletter Ninja Forms Paid Memberships Pro PeepSo Popup Maker Presto Player PrettyLinks Quiz and Survey Master Restrict Content Pro Sensei LMS ShortLinks Pro Simple Feature Requests SliceWP Studiocart SureCart SureMembers The Events Calendar Thrive Apprentice Thrive Cart Thrive Leads Thrive Ovation Thrive Quiz Builder Tutor LMS Ultimate Member Upsell Plugin WhishList Member weForms WooCommerce WooCommerce Shipstation WP All Import WP Booking Calendar WP Fusion WP Job Manager WP Polls WP PostRatings WP Simple Pay WP Ulike WP User Manager WPAdverts WPCode wpDiscuz WPForms WPLMS WS Form Integrated with AI Agents AutomatorWP connects with AI agents to create smarter workflows. We’re continuously working on adding more AI integrations. Anthropic (Claude) Google Gemini Mistral AI Open AI (ChatGPT) Integrated with external platforms AutomatorWP can work with external platforms, furthermore WordPress plugins, like: ActiveCampaign Airtable AWeber Bluesky Campaign Monitor ClickUp ConvertKit Facebook HubSpot Google Calendar Google Drive Google Sheets IFTTT Instagram Integrately Integromat KonnectzIT Mailchimp MailerLite Make Notion Twilio Twitter Typeform Zapier Zoom ⭐ Add-ons to extend AutomatorWP If you’re looking for something endorsed and maintained by the developers who built AutomatorWP, there are a plethora of premium add-ons, the most popular of which include: Webhooks: Send and receive data from webhooks to connect all your plugins with web services like Zapier or Integromat or even to connect different WordPress sites. Schedule Actions: Schedule any action to run after a time delay of your choice. Calculator: Perform mathematical calculations on tags like sums, subtractions, multiplications, divisions and even apply functions such as abs, sin, cos among others. Formatter: Apply different formats to tags like convert, replace or extract anything from strings, numbers or dates even remove the HTML from a content. Generator: Generate content like random strings, random numbers, emails even hashes and WordPress nonces. QR Code: Create QR codes from links or texts with different styles, formats and colors. Multimedia Content: New triggers based on multimedia content creation and interaction. Block Users: Block users and roles for being able to complete any automation of your choice. Button & Link: Launch any automation through buttons and links clicks. Restrict Content: Manage access to any post or page. Custom User Fields: Create new custom fields for WordPress users. CSV: Manage content from CSV files or Google Sheets spreadsheets. User Lists: Create, organize, and manage user lists . View all add-ons ♥️ More plugins from the AutomatorWP team 🕹️ GamiPress – Gamification plugin to boost engagement by rewarding users with points, achievements, badges & ranks. 🔗 ShortLinks Pro – Link management plugin for shortened URLs & branded affiliate links. 📋 BBForms – Code form plugin designed to help you build multipurpose forms in seconds!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C