AutomatorWP: Cross-Site Request Forgery in Zoom/AWeber integration connection
Summary
The AutomatorWP WordPress plugin before version 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them. An attacker can use a Cross-Site Request Forgery (CSRF) attack to make a logged-in administrator replace the stored integration credentials with the attacker's own, so data the site sends to these services is diverted to an account the attacker controls. Exploitation requires that the integration is already connected, that the attacker knows the site's OAuth client identifier, and that an administrator is lured into a malicious request while logged in.
Affected
- AutomatorWP WordPress plugin versions before 6.0.8 (CNA record: 0 to before 6.0.8)
- Affected feature: Zoom and AWeber integration connection flow
Fixed in
- Version 6.0.8 (per WPScan; changelog lists security improvements to the Zoom & Aweber authorization process)
Workaround
- No vendor-published workaround found.
- Update to version 6.0.8 or later.
- Limit permission to modify Zoom and AWeber integration settings to trusted administrators.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Update AutomatorWP to version 6.0.8 or later promptly.
- Check the Zoom and AWeber integration settings for unexpected changes and verify the connected accounts.
- Review administrator accounts and their role assignments.
- Avoid browsing untrusted websites while logged into the WordPress dashboard.
- If compromise is suspected, revoke and reissue the Zoom and AWeber API tokens.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- CVE Record CVE-2026-121472 www.cve.org
- WordPress.org AutomatorWP plugin page and changelog wordpress.org
- VulDB CVE-2026-121472 vuldb.com
- OpenCVE CVE-2026-121472 app.opencve.io
- OffSeq threat tracker for CVE-2026-121472 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:14.
Original description (NVD)
The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.