The vulnerability resides in the AutomatorWP WordPress plugin up to version 6.0.4. A missing privilege‑ceiling validation in the create_user() function of the anonymous‑user action and related WordPress‑integration actions means that any role supplied through a dynamic trigger tag is accepted. An unauthenticated attacker can bind the Role option to a trigger tag such as {comment_author} and, when a site administrator approves a comment, the plugin will invoke create_user() with the supplied value. If the value is ‘administrator’, the plugin creates a new account with full admin rights and sends the generated password through WordPress’s standard new‑user notification email, giving the attacker immediate administrative access.

Affected systems are WordPress sites that have the AutomatorWP – No‑Code Workflow Automation, Integration & Webhooks Plugin (now with AI) installed and running any version up to and including 6.0.4. The vendor is rubengc. The vulnerability is specific to the anonymous‑automation configuration that populates the Role field from a dynamic trigger tag.

The CVSS base score of 7.5 marks this as a severe vulnerability. While the EPSS score is not publicly available and the issue is not currently listed in CISA’s KEV catalog, the impact is substantial if the preconditions are met. Successful exploitation requires only that an anonymous automation be configured with the Role option bound to a dynamic tag and that a site administrator approves a comment; no authentication is required to launch the attack. Once a new administrator account is created, the attacker has full control of the WordPress installation. The risk is therefore high for installations that use the vulnerable plugin version and retain the default anonymous automation setup.