CVE-2026-42775: WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the AutomatorWP WordPress plugin at version 5.7.2 and earlier. The vulnerability is reachable over the network and requires no authentication, but an authenticated victim (such as a site administrator) must interact with a crafted link or page for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session theft, page content modification, and limited disruption of the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can send crafted requests to the target WordPress site from the internet without requiring local or physical access.

• AuthenticationNot required

  No account or credentials are needed to craft and deliver the malicious payload to the target site.

• Victim interactionRequired

  A victim (typically a logged-in administrator or privileged user) must interact with a crafted link or visit a manipulated page for the injected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser, enabling account takeover of the interacting user.
• Modifies the visible content of the WordPress admin interface or front-end pages within the victim's active session.
• Performs actions on behalf of the victim user, such as changing settings or creating new accounts, by abusing their authenticated session.
• Causes limited disruption to the victim's browser session, degrading their ability to interact with the affected WordPress site.