The AutomatorWP plugin for WordPress contains a critical vulnerability that allows authenticated attackers to perform unauthorized actions, potentially leading to remote code execution or privilege escalation.

The plugin fails to perform necessary capability checks within the automatorwp_ajax_import_automation_from_url function, permitting attackers with Subscriber-level access or higher to inject and create malicious automations.

The vulnerability carries a CVSS score of 8.0, indicating a high level of risk to organizational infrastructure. Successful exploitation allows an authenticated attacker to manipulate site automations, which can subsequently be leveraged to execute arbitrary code or escalate privileges, resulting in a complete compromise of the WordPress environment.

Immediate Action: Since a specific patched version is currently unconfirmed, administrators should immediately deactivate the AutomatorWP plugin until a security update is released by the vendor.

Proactive Monitoring: Monitor WordPress audit logs for suspicious automation creation events or unexpected changes to plugin configurations initiated by low-privileged user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected AJAX endpoint and restrict access to the WordPress administrative dashboard to trusted IP addresses only.

Public Exploit Available: Unknown.

Given the potential for remote code execution and privilege escalation, this vulnerability poses a severe threat to the integrity of the affected WordPress site. Security teams must prioritize the deactivation of the AutomatorWP plugin until the vendor provides a verified security update to address the missing capability check.