The AutomatorWP plugin contains a missing capability check in several functions that allows any authenticated WordPress user with Subscriber level or higher to change integration settings and view existing automations. This flaw is a classic example of an authority problem (CWE-862) that enables privilege escalation within the WordPress environment. The impact is that attackers can alter or tamper with automation workflows, potentially leading to data leakage or disruption of automated processes.

Affected systems are WordPress sites running AutomatorWP versions up through 5.3.7 inclusive. The plugin is distributed under the rubengc:AutomatorWP CNA and is expected to be installed via the WordPress plugin directory. Version information is limited to a maximum of 5.3.7, with no specific lower bound indicated.

The CVSS base score of 5.4 places this vulnerability in the medium severity range, reflecting that exploitation requires authenticated access but does not grant full system compromise. The EPSS score of less than 1% indicates a low observed probability of exploitation at this time. Because the flaw is not listed in the CISA KEV catalog, there are no known large‑scale exploit campaigns recorded. The likely attack vector is a legitimate login that the attacker uses to obtain Subscriber level rights, after which the missing capability check is leveraged to manipulate plugin data.