---
id: CVE-2026-118239
title: >-
  AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection
  Hijack via OAuth Callback
summary: >-
  The AutomatorWP  WordPress plugin before 6.0.7 does not check that the user
  completing its Zoom and AWeber integration connections is allowed to do so,
  allowing unauthenticated attackers to replace the stored integration
  credentials with…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-284
product: AutomatorWP
affected:
  - AutomatorWP < 6.0.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T11:46:08.082600Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:58:40.921Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118239'
references:
  - url: 'https://wpscan.com/vulnerability/563d93c0-de76-42b3-be54-cc46bbd46e02/'
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.269Z'
epss: 0.00206
epssPercentile: 0.1072
---

## Overview

The AutomatorWP  WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

## Affected

- `AutomatorWP < 6.0.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.