CVE-2026-42650: WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the AutomatorWP WordPress plugin at version 5.6.7 and earlier. The flaw is reachable over the network with no authentication required and no victim interaction needed, based on the CVSS vector. Successful exploitation allows an attacker to inject malicious scripts into pages served to users, enabling session hijacking, credential theft, or unauthorized actions performed in the context of affected users. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credentials are needed; the attacker can trigger the vulnerability as an unauthenticated visitor.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning exploitation does not depend on a logged-in user clicking a link or taking any other action.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• An attacker can inject scripts that read session cookies or authentication tokens from browsers of users visiting affected pages.
• Injected scripts can perform actions within the WordPress admin or front-end on behalf of authenticated users, such as modifying content or settings.
• The scope is marked Changed (S:C) in the CVSS vector, meaning impact can extend beyond the vulnerable plugin itself to the broader browser session and other resources on the origin.