{"id":"CVE-2026-121472","aliases":["EUVD-2026-123184","GHSA-fh8h-gqm4-44gg"],"status":"published","title":"AutomatorWP \u003c 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00106,"percentile":0.01103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2026-11-11T06:00:10Z","modified":"2026-11-11T12:32:44Z","products":[{"vendor":"ruben garcia","product":"automatorwp"},{"vendor":"unknown","product":"automatorwp"}],"references":[{"url":"https://wpscan.com/vulnerability/b1746ba7-11a6-4946-8ed3-be19e570ad26/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121472"},{"url":"https://wpscan.com/vulnerability/b1746ba7-11a6-4946-8ed3-be19e570ad26"},{"url":"https://github.com/advisories/GHSA-fh8h-gqm4-44gg"}],"sources":{"cve":[{"id":"CVE-2026-121472","title":"AutomatorWP \u003c 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRF","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","status":"published","published":"2026-11-11T06:00:10.898Z","modified":"2026-11-11T11:37:43.595Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123184","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","status":"published","published":"2026-11-11T06:00:10Z","modified":"2026-11-11T11:37:43Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-11T12:28:31.128551Z"}],"ghsa":[{"id":"GHSA-fh8h-gqm4-44gg","title":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom...","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","status":"published","published":"2026-11-11T06:32:41Z","modified":"2026-11-11T12:32:44Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-121472","description":"The AutomatorWP  WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.","status":"published","published":"2026-11-11T06:17:16.443Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}