The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress is vulnerable to unauthorized modification of data due a missing capability check on the automatorwp_ajax_import_automation_from_url function all versions up to, and including, 5.3.6. This makes it possible authenticated attackers, with Subscriber-level access above, create arbitrary which can lead Remote Code Execution or Privilege escalation once such automation activated by administrator