AutomatorWP WordPress Plugin Missing Capability Check Vulnerability Allowing Remote Code Execution

A vulnerability exists in the AutomatorWP WordPress plugin, specifically in versions through 5.3.6, due to a missing capability check in the 'automatorwp_ajax_import_automation_from_url' function. This flaw allows authenticated attackers with Subscriber-level access and above to create arbitrary automations. Once activated by an administrator, these automations could lead to remote code execution or privilege escalation.

Impact

Exploitation of this vulnerability could result in unauthorized data modification, with the potential for remote code execution or privilege escalation, depending on the actions created through the vulnerable function.

Remediation

Users are advised to update the AutomatorWP WordPress plugin to version 5.3.7 or a newer patched version.