{"metadata": {"vulnerability": "CVE-2026-126173", "count": 20, "kinds": {"milestone": 3, "sighting": 12, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-10T20:05:06.160Z", "date_only": false, "value": "2026-11-10T20:05:06.160Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T15:42:28Z", "date_only": false, "value": "2026-11-13T15:42:28.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-126173", "field": "containers.cna.timeline.0.time", "text": "Disclosed"}, {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-126173", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T04:50:39.540Z", "date_only": false, "value": "2026-11-14T04:50:39.540384Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117612992197331103", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "5c0773bc-f4e7-4fb0-bdfb-92a4124e7ebb", "content": "CVE-2026-126173 AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger \u2014 with an 'Is the user ID' field \u2014 to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126173https://www.wordfence.com/threat-intel/vulnerabilities/id/04ea5758-2400-4885-8342-c57d61206ef1?source=cvehttps://automatorwp.com/#automatorwp #AutomatorWP #AutomatorWPWebhooks#CVE_2026_126173#bot", "url": "https://infosec.exchange/users/cve/statuses/117612992197331103"}, {"timestamp": "2026-11-14T05:18:37Z", "date_only": false, "value": "2026-11-14T05:18:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4C36-PQMF-XHHF", "record": "GHSA-4C36-PQMF-XHHF", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-14T06:00:36.986Z", "date_only": false, "value": "2026-11-14T06:00:36.986068Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117613267269476317", "record": "cve-2026-126173", "field": "creation_timestamp", "uuid": "97ddbb56-acf3-4b19-866f-cbc3ac704cc8", "content": "CVE-2026-126173 \u2013 AutomatorWP Webhooks (\u22641.4.4) has a CRITICAL auth bypass (CVSS 9.8). Attackers can reset any WordPress user password, including admins, if certain webhook configs are used. Patch now! https://radar.offseq.com/threat/cve-2026-126173-cwe-862-missing-authorization-in-automatorwp-automatorwp-webhooks-b9427035b1b20d72 #OffSeq #WordPress #Vuln #Security", "url": "https://infosec.exchange/users/offseq/statuses/117613267269476317"}, {"timestamp": "2026-11-14T06:00:39.696Z", "date_only": false, "value": "2026-11-14T06:00:39.696595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3n2at3sf4gl2k", "record": "cve-2026-126173", "field": "creation_timestamp", "uuid": "77f4ca64-f5e1-40d6-a30b-9a9ecfc9975c", "content": "AutomatorWP Webhooks plugin \u22641.4.4 hit by CRITICAL auth bypass (CVSS 9.8). Unauth attackers can reset any WordPress user password. Update plugin & review config now! \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-126173-cwe-862-missing-authorization-in-automatorwp-automatorwp-webhooks-b9427035b1b20d7...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3n2at3sf4gl2k"}, {"timestamp": "2026-11-14T06:07:35.937Z", "date_only": false, "value": "2026-11-14T06:07:35.937966Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3n2athjq6qm2o", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "bb84026c-901f-4b1c-b1bf-3ae1724fc643", "content": "\ud83d\udea8 CVE-2026-126173 \u2014 CVSS 9.8 CRITICAL\n\nThe AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versio...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-126173\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3n2athjq6qm2o"}, {"timestamp": "2026-11-14T06:30:55.769Z", "date_only": false, "value": "2026-11-14T06:30:55.769196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/eslf5p42lbfwe", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "9e5d4dc0-3038-46fe-bb45-19ef4cb184d2", "content": "CVE-2026-126173 - AutomatorWP Pro Webhooks addon\nCVE ID : CVE-2026-126173\n \n Published : Nov. 14, 2026, 5:18 a.m. | 56\u00a0minutes ago\n \n Description : The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and includin...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/eslf5p42lbfwe"}, {"timestamp": "2026-11-14T06:31:30Z", "date_only": false, "value": "2026-11-14T06:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4C36-PQMF-XHHF", "record": "GHSA-4C36-PQMF-XHHF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-14T06:31:30Z", "date_only": false, "value": "2026-11-14T06:31:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4C36-PQMF-XHHF", "record": "GHSA-4C36-PQMF-XHHF", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T06:50:03.193Z", "date_only": false, "value": "2026-11-14T06:50:03.193630Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n2avu5smil2s", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "391a4c21-ce96-453f-8456-a1da90522a1e", "content": "CVE-2026-126173 - automatorwp webhooks\nThe webhook feature in AutomatorWP Pro can be tricked into changing a user\u2019s password without any login check. An attacker could then take over any\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#automatorwpwebhooks #automatorwp #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n2avu5smil2s"}, {"timestamp": "2026-11-14T07:30:36.265Z", "date_only": false, "value": "2026-11-14T07:30:36.265804Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117613621120988923", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "dc1a5476-3d18-4074-82d8-543391b61dfa", "content": "AutomatorWP Pro plugin (\u22641.4.4) suffers a CRITICAL auth bypass (CVE-2026-126173). Unauth attackers can reset any WP user password and take over accounts if webhooks are misconfigured. Restrict webhook setups now. https://radar.offseq.com/threat/the-automatorwp-pro-plugin-for-wordpress-webhook-addon-is-vulnerable-to-authorization-bypass-in-all-347402ba31c0e215 #OffSeq #WordPress #CVE2026_126173 #Security", "url": "https://infosec.exchange/users/offseq/statuses/117613621120988923"}, {"timestamp": "2026-11-14T07:30:40.261Z", "date_only": false, "value": "2026-11-14T07:30:40.261845Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3n2ay4pmlva2v", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "e67fe665-9f16-445f-af5a-17a7ee68fe3c", "content": "AutomatorWP Pro webhook addon (\u22641.4.4) has a CRITICAL auth bypass (CVE-2026-126173). Unauthenticated attackers can reset any WP user password. Audit webhook configs & avoid risky automations. https://radar.offseq.com/threat/the-automatorwp-pro-plugin-for-wordpress-webhook-addon-is-vulnerable-to-a...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3n2ay4pmlva2v"}, {"timestamp": "2026-11-14T08:06:07.985Z", "date_only": false, "value": "2026-11-14T08:06:07.985103Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2dwwzt6fouq", "record": "cve-2026-126173", "field": "creation_timestamp", "uuid": "7f9892ab-06db-47d9-a95f-00a97937a815", "content": "Developing: Critical AutomatorWP Pro Vulnerability (CVE-2026-126173)\nhttps://cyber.eventmonitor.net/incident/EM-20261114-YJX2/critical-automatorwp-pro-vulnerability-cve-2026-126173/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2dwwzt6fouq"}, {"timestamp": "2026-11-14T08:30:10.673Z", "date_only": false, "value": "2026-11-14T08:30:10.673839Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3n2b3h6a3gp2b", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "17418c3c-761d-4f8c-8535-fcf5c1d62304", "content": "New critical CVSS \u2014 worth tracking. CVE-2026-126173 \u2014 CVSS 9.8.\n\nThe AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-126173/\n\n#fcvulns #Wordpress", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3n2b3h6a3gp2b"}, {"timestamp": "2026-11-14T09:00:09Z", "date_only": false, "value": "2026-11-14T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110629", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "56090161-035d-4e51-9c7e-3bb3da8bb2d9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-126173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-14 08:40:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110629", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-14T09:00:09Z", "date_only": false, "value": "2026-11-14T09:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/110629", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "45e980a8-2b55-408e-81f9-54a992e21d48", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-126173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-14 08:40:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110629"}], "metrics": {"as_of": "2026-11-14T13:07:10.481Z", "anchors": {"origin": {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-14T09:00:09Z", "date_only": false, "value": "2026-11-14T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110629", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "56090161-035d-4e51-9c7e-3bb3da8bb2d9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-126173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-14 08:40:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110629", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 15238.943, "hours": 4.233039722222222, "days": 0.1763766550925926, "min_seconds": 15238.943, "max_seconds": 15238.943, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T09:00:09Z", "date_only": false, "value": "2026-11-14T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110629", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "56090161-035d-4e51-9c7e-3bb3da8bb2d9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-126173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-14 08:40:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110629", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 30060.424872, "hours": 8.35011802, "days": 0.3479215841666667, "min_seconds": 30060.424872, "max_seconds": 30060.424872, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T04:46:10.057Z", "date_only": false, "value": "2026-11-14T04:46:10.057Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126173", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T13:07:10.481Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 14821.481872, "hours": 4.117078297777778, "days": 0.17154492907407407, "min_seconds": 14821.481872, "max_seconds": 14821.481872, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T09:00:09Z", "date_only": false, "value": "2026-11-14T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110629", "record": "CVE-2026-126173", "field": "creation_timestamp", "uuid": "56090161-035d-4e51-9c7e-3bb3da8bb2d9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-126173\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-14 08:40:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110629", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T13:07:10.481Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}