CVE-2026-126173
validatedZero produced an exploit or a check.description
AutomatorWP Pro Webhooks versions through 1.4.4 can allow unauthenticated password resets when a webhook automation is configured to update a user with its password taken from webhook data. An attacker could take over affected WordPress accounts, including administrator accounts, but only where that specific Receive Webhook-to-Update User automation configuration is present.
mitigation
Disable or remove webhook automations that pair a Receive Webhook trigger using the user-ID option with an Update User action that accepts a password from webhook data. Restrict or disable externally reachable webhook handling until an updated release is available.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-14 04:46Zcve_org: trigger signal, started the run
- 2026-11-14 05:12Z
this entry in the feed
GET /api/v1/feed/CVE-2026-126173
{ "etk_id": "ETK-2026-4443", "cve_id": "CVE-2026-126173", "display_id": "CVE-2026-126173", "ghsa_id": null, "euvd_id": null, "status": "published", "anchor_state": "anchored", "title": "Authorization bypass in AutomatorWP Webhooks", "summary": "AutomatorWP Pro Webhooks versions through 1.4.4 can allow unauthenticated password resets when a webhook automation is configured to update a user with its password taken from webhook data. An attacker could take over affected WordPress accounts, including administrator accounts, but only where that specific Receive Webhook-to-Update User automation configuration is present.", "mitigation": "Disable or remove webhook automations that pair a Receive Webhook trigger using the user-ID option with an Update User action that accepts a password from webhook data. Restrict or disable externally reachable webhook handling until an updated release is available.", "vendor": "AutomatorWP", "product": "AutomatorWP Webhooks", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.4.4" ], "ecosystem": null, "fixed_versions": [], "package_name": "AutomatorWP Webhooks", "purl": null } ], "cwes": [ 862 ], "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.32110415, "t0_at": "2026-11-14T04:46:10.057000+00:00", "signals": { "check": { "at": "2026-11-14T05:12:17.875776+00:00", "days": 0.018146050648148147, "is_lower_bound": false, "measured_at": "2026-11-14T04:46:10.057000+00:00", "url": null }, "trigger_signal": { "at": "2026-11-14T04:46:10.057000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-14T04:46:10.057000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-126173" } } }
published 2026-11-14 05:11Z
last change 2026-11-14 05:12Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.