CVE-2026-126173: AutomatorWP Pro Webhook Authorization Bypass Enables Full WordPress Admin Takeover — Detection and Remediation Guide

---
title: AutomatorWP Webhook Endpoint Suspicious Access
description: Detects inbound HTTP requests to AutomatorWP webhook receiver endpoints with characteristics consistent with CVE-2026-126173 exploitation — specifically POST requests to the webhook automation URL pattern that could trigger unauthorized user update actions.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126173
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/automatorwp/'
      - '/automatorwp-webhook'
  selection_method:
    cs-method: 'POST'
  selection_no_auth:
    sc-status: 200
  condition: selection_uri and selection_method and selection_no_auth
falsepositives:
  - Legitimate webhook deliveries from configured external services
  - WordPress AJAX calls from authenticated sessions
level: high
---
title: WordPress Admin Password Reset Followed by Login
description: Detects a password change event on a WordPress administrator account followed by a successful login from an external IP address within a short window — indicative of account takeover via CVE-2026-126173.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126173
logsource:
  category: application
  product: wordpress
detection:
  selection_event:
    EventType:
      - 'password_reset'
      - 'user_updated'
  selection_role:
    UserRole|contains:
      - 'administrator'
  condition: selection_event and selection_role
falsepositives:
  - Legitimate admin-initiated password resets
  - Automated provisioning workflows
level: critical
---
title: New Plugin or Theme Installation on WordPress
description: Detects installation of new plugins or themes on a WordPress site, which is a common post-exploitation action following administrator account compromise via vulnerabilities like CVE-2026-126173. Attackers frequently upload webshells or malicious plugins after gaining admin access.
author: Security Arsenal
date: 2026/04/06
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126173
  - https://attack.mitre.org/techniques/T1505/003/
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/wp-content/plugins/'
      - '/wp-content/themes/'
      - '/wp-content/uploads/'
  selection_write:
    TargetFilename|endswith:
      - '.php'
      - '.zip'
  condition: selection_paths and selection_write
falsepositives:
  - Legitimate plugin/theme installations by site administrators
  - Automated WordPress update processes
level: medium

// Hunt 1: Suspicious POST requests to AutomatorWP webhook endpoints
// Looks for unauthenticated POST requests matching webhook receiver patterns
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod == "POST"
| where RequestURL has_any (
    "automatorwp",
    "admin-ajax.php"
    )
| where RequestURL has_any (
    "webhook",
    "automatorwp-webhook",
    "action=automatorwp"
    )
| extend SourceIP = SourceIP, DestinationHost = DestinationHostName
| summarize RequestCount = count(), DistinctURLs = dcount(RequestURL), URLs = make_set(RequestURL, 10) by SourceIP, DestinationHost, bin(TimeGenerated, 1h)
| where RequestCount > 5
| sort by RequestCount desc

// Hunt 2: Password reset followed by successful login (account takeover pattern)
// Requires WordPress security plugin logs (e.g., Wordfence, iThemes) ingested via Syslog
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("password", "reset", "user_updated")
| where SyslogMessage has "admin"
| extend EventTime = TimeGenerated, Message = SyslogMessage
| summarize ResetEvents = count() by Computer, bin(TimeGenerated, 15m)
| where ResetEvents >= 1
| join kind=inner (
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any ("login", "authenticated", "session")
    | where SyslogMessage has "success"
) on Computer
| where TimeGenerated1 between (TimeGenerated .. TimeGenerated + 15m)
| project TimeGenerated, Computer, ResetEvents, LoginMessage = SyslogMessage1

// Hunt 3: New PHP files written to WordPress content directories (webshell staging)
// Requires File Integrity Monitoring or Sysmon data ingested into Sentinel
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (
    "wp-content/plugins",
    "wp-content/themes",
    "wp-content/uploads"
    )
| where FileName endswith ".php"
| where ActionType == "FileCreated"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName
| sort by TimeGenerated desc

-- Hunt for recently modified PHP files in WordPress content directories
-- Indicative of webshell deployment or malicious plugin/theme installation
-- following CVE-2026-126173 admin account takeover

SELECT
    FullPath,
    Size,
    Mtime AS ModifiedTime,
    Ctime AS CreatedTime,
    Btime AS BirthTime
FROM glob(globs=[
    '/var/www/*/wp-content/plugins/**/*.php',
    '/var/www/*/wp-content/themes/**/*.php',
    '/var/www/*/wp-content/uploads/**/*.php',
    '/home/*/public_html/wp-content/plugins/**/*.php',
    '/home/*/public_html/wp-content/themes/**/*.php',
    '/home/*/public_html/wp-content/uploads/**/*.php'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-126173 — AutomatorWP Pro Webhooks Addon Vulnerability Checker
# Run on WordPress hosting server. Requires read access to wp-content and WP-CLI.
# Usage: bash check-cve-2026-126173.sh [wordpress_root_path]

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/automatorwp-pro-webhooks"
PLUGIN_MAIN="$PLUGIN_DIR/automatorwp-pro-webhooks.php"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "==================================================="
echo " CVE-2026-126173 — AutomatorWP Pro Webhooks Checker"
echo "==================================================="
echo ""
echo "[*] WordPress root: $WP_ROOT"
echo ""

# Check 1: Is the plugin directory present?
echo "[CHECK 1] Checking for AutomatorWP Pro Webhooks plugin directory..."
if [ -d "$PLUGIN_DIR" ]; then
    echo -e "  ${YELLOW}[FOUND]${NC} Plugin directory exists: $PLUGIN_DIR"

    # Check 2: What version is installed?
    echo ""
    echo "[CHECK 2] Checking plugin version..."
    if [ -f "$PLUGIN_MAIN" ]; then
        VERSION=$(grep -i "Version:" "$PLUGIN_MAIN" | head -1 | awk '{print $NF}')
        echo "  Installed version: $VERSION"
        if [ -n "$VERSION" ]; then
            # Compare version against 1.4.4
            if [ "$(printf '%s\n' "1.4.4" "$VERSION" | sort -V | head -1)" = "$VERSION" ] && [ "$VERSION" != "1.4.5" ]; then
                echo -e "  ${RED}[VULNERABLE]${NC} Version $VERSION is <= 1.4.4 — IMMEDIATE ACTION REQUIRED"
            else
                echo -e "  ${GREEN}[PATCHED]${NC} Version $VERSION appears to be newer than 1.4.4"
            fi
        fi
    else
        echo -e "  ${YELLOW}[WARN]${NC} Main plugin file not found — check directory contents manually"
        ls -la "$PLUGIN_DIR"
    fi

    # Check 3: Look for webhook automations in the database via WP-CLI
    echo ""
    echo "[CHECK 3] Checking for webhook automations with exploitable configuration..."
    if command -v wp &> /dev/null; then
        echo "  Querying AutomatorWP automations with Receive Webhook triggers..."
        wp --path="$WP_ROOT" db query \
            "SELECT p.ID, p.post_title, pm.meta_value
             FROM wp_posts p
             JOIN wp_postmeta pm ON p.ID = pm.post_id
             WHERE p.post_type LIKE 'automator%'
             AND pm.meta_value LIKE '%webhook%'" 2>/dev/null
        if [ $? -eq 0 ]; then
            echo -e "  ${YELLOW}[REVIEW]${NC} Examine the above automations for Receive Webhook triggers paired with Update-User actions"
            echo "  Look for Update-User actions where the User ID field is blank"
        else
            echo -e "  ${YELLOW}[WARN]${NC} WP-CLI query failed — check database access or table prefix"
        fi
    else
        echo -e "  ${YELLOW}[SKIP]${NC} WP-CLI not found. Install WP-CLI or check automations manually in WordPress admin."
    fi

    # Check 4: Recent webhook-related entries in web server access logs
    echo ""
    echo "[CHECK 4] Checking access logs for suspicious webhook requests (last 24h)..."
    for LOGFILE in /var/log/apache2/access.log /var/log/nginx/access.log /var/log/httpd/access_log; do
        if [ -f "$LOGFILE" ]; then
            HITS=$(grep -i "automatorwp\|webhook" "$LOGFILE" | grep "POST" | grep "$(date -d '24 hours ago' '+%d/%b/%Y' 2>/dev/null || date '+%d/%b/%Y')" | wc -l)
            if [ "$HITS" -gt 0 ]; then
                echo -e "  ${RED}[ALERT]${NC} Found $HITS POST request(s) to webhook endpoints in $LOGFILE (last 24h)"
                grep -i "automatorwp\|webhook" "$LOGFILE" | grep "POST" | tail -20
            else
                echo -e "  ${GREEN}[CLEAN]${NC} No recent POST requests to webhook endpoints found in $LOGFILE"
            fi
        fi
    done

else
    echo -e "  ${GREEN}[NOT FOUND]${NC} AutomatorWP Pro Webhooks plugin directory not present — likely not affected"
fi

# Check 5: Recent PHP file modifications in wp-content (post-exploitation indicator)
echo ""
echo "[CHECK 5] Checking for recently modified PHP files in wp-content (last 48h)..."
RECENT_PHP=$(find "$WP_ROOT/wp-content" -name "*.php" -mmin -2880 -type f 2>/dev/null | head -20)
if [ -n "$RECENT_PHP" ]; then
    echo -e "  ${YELLOW}[REVIEW]${NC} Recently modified PHP files found (verify these are legitimate):"
    echo "$RECENT_PHP"
else
    echo -e "  ${GREEN}[CLEAN]${NC} No PHP files modified in wp-content within the last 48 hours"
fi

echo ""
echo "==================================================="
echo " RECOMMENDED ACTIONS"
echo "==================================================="
echo "1. UPDATE AutomatorWP Pro Webhooks addon to the latest patched version immediately"
echo "2. If no patch is available, DEACTIVATE the Webhooks addon until patched"
echo "3. REVIEW all automations using Receive Webhook + Update-User actions"
echo "4. Ensure the User ID field in Update-User actions is explicitly set"
echo "5. FORCE PASSWORD RESET for all administrator accounts as a precaution"
echo "6. REVIEW WordPress user list for unauthorized accounts"
echo "7. AUDIT installed plugins/themes for unauthorized additions"
echo "==================================================="