CVE-2026-42775

Executive Summary

CVE-2026-42775 is an Unauthenticated Cross-Site Scripting (XSS) vulnerability discovered in the AutomatorWP WordPress plugin, affecting versions 5.7.2 and below. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript into the application, which executes in the context of an authenticated administrator's browser session. The vulnerability stems from improper sanitization of user-supplied input within the plugin's automation trigger or action parameters, which are then reflected or stored without adequate escaping.

Given that AutomatorWP is a widely used plugin for creating automated workflows in WordPress, this vulnerability poses a significant risk to site integrity and user data. An attacker can leverage this XSS to perform actions such as creating rogue admin accounts, exfiltrating session cookies, or injecting backdoors into the WordPress environment. The CVSS score of 7.1 (High) reflects the ease of exploitation and the potential for complete compromise of the WordPress instance.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem, specifically the automatorwp package available via the official WordPress Plugin Directory. Since the plugin is distributed through the WordPress update mechanism, any site running an unpatched version is at risk. The lack of a confirmed patch or advisory from the vendor increases the urgency for manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim (admin) must click a crafted link or visit a malicious page.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component (e.g., WordPress admin panel).
• Confidentiality (C): Low – Limited data exfiltration possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct denial of service.

Threat Level: High. The combination of unauthenticated access and the ability to target administrators makes this a critical vector for full site takeover.

Deep Dive & Mechanics

The vulnerability resides in how AutomatorWP processes user-supplied data within its automation rules. The plugin allows administrators to define triggers (e.g., "User submits a form") and actions (e.g., "Send an email"). However, certain input fields, such as custom action parameters or trigger conditions, are not properly sanitized before being rendered in the WordPress admin dashboard.

An attacker can craft a malicious URL or POST request containing JavaScript payloads in parameters like action_data, trigger_args, or similar. When an administrator views the automation logs or configuration pages, the injected script executes in their browser session. Because the plugin does not enforce nonce checks or input validation on these parameters, the attack can be performed without authentication.

Key vulnerable components:

• automatorwp_ajax_get_trigger_data (AJAX handler)
• automatorwp_render_action_fields (rendering function)
• Log viewer pages that display raw trigger/action data

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (PHP):

// In automatorwp-ajax-functions.php
function automatorwp_ajax_get_trigger_data() {
    $trigger_id = $_POST['trigger_id'];
    $trigger_data = get_post_meta($trigger_id, 'automatorwp_trigger_data', true);
    // Directly outputting without escaping
    echo $trigger_data['action_parameter'];
    wp_die();
}

Patched Code (Hypothetical):

function automatorwp_ajax_get_trigger_data() {
    $trigger_id = intval($_POST['trigger_id']);
    $trigger_data = get_post_meta($trigger_id, 'automatorwp_trigger_data', true);
    // Properly escape output
    echo esc_html( $trigger_data['action_parameter'] );
    wp_die();
}

The fix involves using esc_html() or wp_kses_post() to sanitize output, and validating that the user has manage_options capability before processing AJAX requests.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with AutomatorWP <= 5.7.2 installed and activated.
• An admin user session (the victim).

Exploit Steps:

1. Identify a vulnerable endpoint, e.g., wp-admin/admin-ajax.php?action=automatorwp_get_trigger_data.
2. Craft a payload that injects JavaScript into a parameter, such as trigger_id or action_data.
3. Send the malicious request to the victim admin (e.g., via a phishing email with a crafted link).
4. When the admin views the automation logs, the script executes.

Example Payload (URL-encoded):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=automatorwp_get_trigger_data&trigger_id=1&action_data=<script>alert('XSS')</script>

Expected Outcome: The JavaScript executes in the admin's browser, allowing session hijacking or admin account creation.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with action=automatorwp_* parameters containing <script> or onerror patterns.
2. Review WordPress debug logs for unexpected output in plugin-related pages.
3. Use a Web Application Firewall (WAF) to block requests containing JavaScript event handlers in POST parameters.

Mitigation Steps:

1. Disable the AutomatorWP plugin until a patch is released.
2. Implement a Content Security Policy (CSP) that restricts script execution.
3. Enforce strict input validation and output escaping via a custom plugin or mu-plugin.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=automatorwp_get_trigger_data and suspicious action_data values.
  • Outbound connections from the WordPress server to attacker-controlled domains (e.g., for cookie exfiltration).

• File IOCs:

  • Modified wp-config.php or theme files containing eval(base64_decode(...)) statements.
  • New admin users created with usernames like support_xyz or wp_admin_backup.

• Log IOCs:

  • WordPress debug.log entries showing PHP Notice: Undefined index: action_data or similar.
  • Apache/Nginx access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule Detect_AutomatorWP_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting AutomatorWP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-42775"
    strings:
        $xss1 = /action=automatorwp_[a-z_]+&[^&]*<script[^>]*>/
        $xss2 = /action=automatorwp_[a-z_]+&[^&]*onerror\s*=\s*["']/
        $xss3 = /action=automatorwp_[a-z_]+&[^&]*onload\s*=\s*["']/
    condition:
        any of them
}

Sigma Rule

title: AutomatorWP Unauthenticated XSS Attempt
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1a5f8c7b
status: experimental
description: Detects attempts to exploit CVE-2026-42775 via AJAX requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=automatorwp_'
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate plugin functionality with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42775 AutomatorWP XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=automatorwp_"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate AutomatorWP until a patched version is released.
2. Apply virtual patching – Use a WAF to block requests containing action=automatorwp_ with suspicious payloads.
3. Audit user accounts – Check for unauthorized admin accounts created via XSS.

Long-term Fix:

• Monitor the AutomatorWP plugin page for an official update.
• Once patched, update to the latest version immediately.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact:

  Header set Content-Security-Policy "script-src 'self';"
  

Workaround (if plugin must remain active):

• Add a custom mu-plugin that forces output escaping on all AutomatorWP AJAX responses:

  add_action('wp_ajax_automatorwp_get_trigger_data', function() {
      // Override with sanitized output
  }, 1);
  

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2026-42775