WordPress plugin
AutomatorWP Webhooks security & vulnerabilities
Closed on WordPress.org
This plugin is no longer available on WordPress.org and will not receive security fixes. Replace it with a maintained alternative.
- Critical1
- High0
- Medium0
- Low0
All AutomatorWP Webhooks vulnerabilities
Nothing in this view
No vulnerabilities match this filter. Show all.
AutomatorWP Webhooks: common questions
Does AutomatorWP Webhooks have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in AutomatorWP Webhooks: 1 critical. The plugin has been closed on WordPress.org.
How do I check which version of AutomatorWP Webhooks I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent AutomatorWP Webhooks vulnerability?
CVE-2026-126173, published Nov 13, 2026: AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field. Severity: Critical (CVSS 9.8).
Is any AutomatorWP Webhooks vulnerability listed in CISA KEV?
No. None of the known AutomatorWP Webhooks vulnerabilities is currently listed in the CISA KEV catalog.