The AutomatorWP plugin for WordPress lacks a proper authorization check on the automatorwp_convertkit_get_forms AJAX action. This flaw allows any authenticated user with subscriber-level or higher privileges to retrieve complete ConvertKit form data that was configured by the site’s manager. The exposed data includes integration details that are meant to be restricted solely to plugin managers, resulting in a disclosure of sensitive information. The weakness is a classic authorization bypass, identified as CWE‑862.

WordPress sites running AutomatorWP plugin version 5.8.4 or earlier, including the 5.8.x release line from the rubengc vendor. No other products are explicitly mentioned as affected in the CNA data.

The CVSS score of 4.3 indicates moderate overall severity. Because the EPSS score is not available, the exploitation probability is unknown, but the flaw is not listed in the CISA KEV catalog. An attacker requires only authentication and a subscriber-level account, which is very common on WordPress sites. The attack vector is an authenticated, AJAX‑based request; the required nonce is placed on every admin page, so any logged‑in user can obtain it and trigger the vulnerable action. Attackers could therefore harvest sensitive integration data without administrative access.