CVE WatchNov 11, 2026

CVE-2026-121472

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the a

CVSS

5.0

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-352

EPSS · 30d

Not enough EPSS history yet.

Technical description

The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.

Official references

wpscan.comhttps://wpscan.com/vulnerability/b1746ba7-11a6-4946-8ed3-be19e570ad26/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1257848.8 HIG

—

———Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.1h CVE-2026-1217705.4 MED

—

———Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5.1h CVE-2026-1260673.1 LOW

—

———Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.16h CVE-2026-1253396.1 MED

—

——0Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.17h CVE-2026-1181526.5 MED

—

——0Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.17h CVE-2026-1094817.5 HIG

—

——0Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.16h