The AutomatorWP plugin contains a missing capability check on the automatorwp_ajax_import_automation_from_url function, allowing any authenticated user with Subscriber access or higher to create arbitrary automations. Those automations can contain malicious code that is executed when an administrator activates them, leading to remote code execution and potential privilege escalation. The attack grants control over the WordPress site, compromising confidentiality, integrity, and availability.

WordPress sites running the AutomatorWP – Automator plugin version 5.3.6 or earlier are affected. The plugin is provided by rubengc. All prior releases to and including 5.3.6 lack the necessary authorization check.

The CVSS score of 8 indicates high severity, but the EPSS score of less than 1% suggests a low to moderate likelihood of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an authenticated attacker who can log into the site as a Subscriber or higher; by calling the protected endpoint they can craft a malicious automation, which is then executed when an administrator activates it.