CVE-2021-24717

8.8 highEPSS 1.3%

High (8.8) in automatorwp automatorwp. EPSS 1.3% chance of exploitation in the next 30 days.

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2021-11-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

automatorwp:automatorwp

References

https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f
https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f

Check your stack JSON