A critical authorization flaw in the AutomatorWP Pro Webhooks addon can let unauthenticated attackers reset WordPress passwords, including those belonging to administrators. Wordfence’s advisory identifies the issue as CVE-2026-126173 and assigns a CVSS score of 9.8.
Exploitation depends on a particular automation. A Receive Webhook trigger must contain an “Is the user ID” field and connect to an Update-User action. That action’s User ID field must be blank, with its Password field mapped to the webhook password tag. Wordfence describes this combination as a documented, supported configuration.
The addon fails to check whether the requester is authorized to perform the action. Under those conditions, an attacker can take over an account through a password reset.
Versions through 1.4.4 are affected. Administrators should update to 1.4.5 or a newer patched release and review relevant webhook automations. Installing the addon alone does not establish that the vulnerable workflow is present.
