MEDIUMCVSS v3.1 5.6Vulnerability
CVE-2026-118239
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Epss score
- 0.00184
- Cvss severity
- MEDIUM
- Cvss score
- 5.6
- Retrieved at
- 2026-11-07T06:44:43+00:00
- Last source
- FIRST EPSS
- Score
- 5.6
- Cvss version
- 3.1
- Cve id
- CVE-2026-118239
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- First seen by Signal
- 2026-11-06T10:16:10+00:00
- Name
- CVE-2026-118239
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Published at
- 2026-11-06T06:16:41.140
- Last modified
- 2026-11-06T20:09:13.780
- Epss percentile
- 0.08055
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph