https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:04:25 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-76074 <p>The AutomatorWP – Automator plugin for no-code automations, webhooks &amp; custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site&#39;s configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin&#39;s manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.</p> <p>The AutomatorWP – Automator plugin for no-code automations, webhooks &amp; custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site&#39;s configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin&#39;s manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-76074 https://vulnerability.circl.lu/vuln/ghsa-572x-42mx-f8fj <p>The AutomatorWP – Automator plugin for no-code automations, webhooks &amp; custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site&#39;s configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin&#39;s manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.</p> <p>The AutomatorWP – Automator plugin for no-code automations, webhooks &amp; custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site&#39;s configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin&#39;s manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.</p> https://vulnerability.circl.lu/vuln/ghsa-572x-42mx-f8fj