The plugin fails to verify that a user has the proper capability when executing the automatorwp_campaign_monitor_get_lists AJAX action. Because the nonce is available to every visitor of any admin page, any user with Subscriber-level access can invoke the action and retrieve a list of Campaign Monitor mailing list IDs and names. This disclosure of configuration data can aid attackers in building phishing campaigns or planning further attacks against the website or its users.

Affected installations are WordPress sites running the AutomatorWP plugin up to and including version 5.8.4. The vulnerability exists in the default settings of the plugin and is not limited by additional configuration. Site owners who have not upgraded to a newer, patched version are at risk.

The CVSS score of 4.3 indicates a low to moderate impact. Because the vulnerability requires only authenticated access at Subscriber level—a role commonly available on most sites—and no additional exploitation step is required, the threat is moderate. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, but the lack of proper authorization control makes it a notable flaw that should be addressed promptly.