CVE-2026-118239— AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
Quick assessment
Affected
Unknown AutomatorWP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 6.0.7 版本之前，AutomatorWP WordPress 插件未对执行 Zoom 和 AWeber 集成连接的用户进行权限校验，导致未认证的攻击者能够替换已存储的集成凭据，将其替换为攻击者控制的凭据，从而将网站发送给这些服务的数据劫持至攻击者控制的账户中。成功利用该漏洞需要满足两个前提：相关集成必须已处于连接状态，且攻击者需知晓该站点的 OAuth 客户端标识符。
Possible ATT&CK Techniques 2 AI
T1560 · Archive Collected Data T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118239
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | AutomatorWP | 0 ~ 6.0.7 | - |
|
II. Public POCs for CVE-2026-118239
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118239
请登录查看更多情报信息。
Other References for CVE-2026-118239 (1)
-
https://wpscan.com/vulnerability/563d93c0-de76-42b3-be54-cc46bbd46e02/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total
| CVE-2026-118423 | 10.0 CRITICAL | WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload |
| CVE-2026-88800 | 9.1 CRITICAL | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Rol |
| CVE-2026-88799 | 8.8 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover |
| CVE-2026-88801 | 8.0 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro |
| CVE-2026-121633 | 5.3 MEDIUM | Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste |
| CVE-2026-121636 | 5.3 MEDIUM | Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the |
| CVE-2026-118166 | 4.8 MEDIUM | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution vi |
| CVE-2026-113615 | GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi | |
| CVE-2026-118188 | PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure | |
| CVE-2026-115673 | Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email | |
| CVE-2026-118167 | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override | |
| CVE-2026-118187 | PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR | |
| CVE-2026-118186 | PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi | |
| CVE-2026-86606 | iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser | |
| CVE-2026-110813 | Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam | |
| CVE-2026-110525 | MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent | |
| CVE-2026-92396 | Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css | |
| CVE-2026-12967 | WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass | |
| CVE-2026-87784 | Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission | |
| CVE-2026-119259 | All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: AutomatorWP
-
CVE-2026-78266
WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Contro -
CVE-2026-42775
WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting -
CVE-2026-42650
WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting -
CVE-2026-40785
WordPress AutomatorWP plugin <= 5.6.7 - Broken Authenticatio -
CVE-2025-68561
WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulner
Same vendor: Unknown
-
CVE-2026-121636
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IP -
CVE-2026-121633
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmatio -
CVE-2026-118166
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Ar -
CVE-2026-118423
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary Fi -
CVE-2026-88801
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 -