The vulnerability is a broken authentication flaw (CWE‑288) in WordPress AutomatorWP plugin versions up to 5.6.7. It allows an attacker to impersonate any user without providing valid credentials, potentially giving them unauthorized access to administrative functions or to content creation and automation workflows. The impact includes unauthorized disclosure of site content, modification of site data, and possible further privilege escalation.

The affected product is the WordPress AutomatorWP plugin developed by Ruben Garcia. All releases through 5.6.7 are vulnerable; newer releases (5.6.8 and later) contain a patch that restores correct authentication handling. Sites that run any of these affected versions—particularly those using the plugin for critical automation tasks—are at risk.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, meaning no known large‑scale exploits have been reported yet. The likely attack vector is a web‑based authentication request; attackers can submit requests that bypass authentication checks. Even though exploitation is not widespread, the risk to sites that remain unpatched is significant, especially if the plugin is used by privileged accounts.