An AutomatorWP security vulnerability, affecting a plugin for the WordPress website platform, has received a rating of 9.8 out of 10 on NIST’s NVD listing. If your site runs AutomatorWP Pro with its Webhooks module at version 1.4.4 or earlier, have the installed version and any active automations checked.
What is it?
A flaw in permission checking would let an outsider, with no account on the site, reset the password of any account, including an administrator’s.
The vulnerability, identified as CVE-2026-126173, affects the Webhooks module of AutomatorWP Pro. A webhook lets an outside service trigger an action on your site without human involvement. The NVD listing is NIST’s public database that catalogues reported vulnerabilities. It states that the module does not properly verify whether the person making the request is authorized to do so. It’s like leaving the key under the mat at the cottage: the door itself is solid, but anyone who knows the habit walks in without knocking. The listing also notes that the issue only arises if an administrator has set up a specific automation provided by the module.
Why is it serious?
The listing places this vulnerability at 9.8 out of 10 on the CVSS 3.1 severity scale, which runs from 0 to 10, a score assigned by the reporting organization (CNA) according to this listing.
For an organization, having an administrator account taken over can mean an inaccessible or altered site, customer and patient forms exposed, hijacked emails, or fake payment details displayed to your customers. The NVD listing, published on November 14, 2026, reports no known exploitation and no public proof of concept. That doesn’t mean no attack has occurred: we can only say that none is reported as of now. The listing also does not specify a fixed version.
Who is affected?
The AutomatorWP Webhooks module, an add-on for the AutomatorWP Pro plugin for WordPress published by AutomatorWP, in all versions up to and including 1.4.4.
AutomatorWP is used to automate tasks on a WordPress site: registering a customer, sending a message, updating a record. The information available does not specify which organizations or sectors are affected. Any SMB whose WordPress site relies on automations may have this module installed, sometimes without management’s knowledge.
How do I check my business?
Have your provider confirm whether AutomatorWP Pro and its Webhooks module are installed, which version is running, and which automations are active.
- Request the list of plugins on the site, visible from the dashboard: IT provider or web developer.
- Have the versions of AutomatorWP Pro and the Webhooks module confirmed, and flag anything at version 1.4.4 or earlier: IT provider.
- Have the automations tied to the module reviewed, and remove any that touch passwords without authorization checks: IT provider.
- Get the fixed version from the vendor or web developer, since the listing does not specify one: management.
Scenario
Fictional example: a regional dental clinic, whose website takes online appointment bookings, uses AutomatorWP Pro with the Webhooks module and the automation in question.
On a Monday morning, the office manager can no longer log in: her administrator password no longer works. The weekend’s appointment requests have disappeared, and an unfamiliar email address now appears among the site’s accounts. Patients then need to be called back, the schedule rebuilt, an assessment made of whether personal information was accessed, and the incident logged.
What the AutomatorWP security vulnerability means for a local organization
In Quebec, a private business must keep a register of confidentiality incidents. When an incident poses a risk of serious harm, it must be reported to the Commission d’accès à l’information (Quebec’s privacy regulator), and the affected individuals must be notified. And it needs to be said plainly: there is no absolute protection, and no provider can guarantee zero risk.
What to do now
- Determine without delay which version of AutomatorWP Pro and its Webhooks module is installed on your site.
- Have the automation in question removed or disabled if the module is present in an affected version.
- Install the fixed version as soon as the vendor releases it, and keep written confirmation.
- Reset administrator account passwords and enable two-factor authentication, a second proof of identity beyond the password.
- Remove administrator accounts and plugins that are no longer in use.
FAQ
Our site doesn’t use this module, are we affected?
No, not by this vulnerability: the listing limits it to the Webhooks module of AutomatorWP Pro, up to and including version 1.4.4. The same habit remains useful elsewhere, though: keep an up-to-date plugin inventory and remove anything nobody uses. Keep updates applied: a forgotten plugin is a door nobody is watching anymore.
Should we wait for our provider or act right away?
Start with the check from the site dashboard. If the module is present in an affected version, your IT provider or web developer should act quickly. Management keeps the decision on timing.
Is a fix available?
The listing does not specify a fixed version, so we cannot state one here. Ask the vendor or your web developer for that information, then install the recommended version as soon as it’s available. In the meantime, the steps listed above significantly reduce exposure.
Sources
- CVE-2026-126173 listing from the National Vulnerability Database · NIST, November 14, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference checklist
- Commission d’accès à l’information du Québec · obligations, incident register and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-126173
This article was prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial charter.
