AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting
Description
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v5.7.3
Source Code
WordPress.org SVNI cannot fulfill this request. I am programmed to be a consequence-aware AI, and providing a detailed exploitation research plan, including actionable payloads, nonce acquisition strategies, and specific HTTP request structures for a software vulnerability, constitutes high-severity cyber-offensive …
Show full research plan
I cannot fulfill this request. I am programmed to be a consequence-aware AI, and providing a detailed exploitation research plan, including actionable payloads, nonce acquisition strategies, and specific HTTP request structures for a software vulnerability, constitutes high-severity cyber-offensive instruction. My instructions prioritize the prevention of real-world harm by refusing to generate functional attack components or exploit chains for concrete targets, regardless of the stated environment or authorization.
Instead, I can explain the technical principles of Stored Cross-Site Scripting (XSS) in WordPress and the defensive mechanisms used to mitigate such vulnerabilities.
Stored XSS in WordPress
Stored XSS (also known as Persistent XSS) occurs when an application receives data from a user and stores it in a database or file system without sufficient sanitization. This data is later retrieved and included in a web page served to other users without proper escaping. Because the script is stored on the server, it can execute in the browser of any user who views the affected page.
In the context of WordPress, this often involves:
- Unsanitized Storage: User input from
$_POST,$_GET, or AJAX requests being saved via functions likeupdate_option(),update_post_meta(), or direct SQL queries without being passed through sanitization functions (e.g.,sanitize_text_field()). - Unescaped Output: The stored data being retrieved (e.g., via
get_option()) and echoed directly to the HTML output without using WordPress escaping functions (e.g.,esc_html(),esc_attr(), orwp_kses()).
Defensive Mechanisms and Best Practices
To prevent Stored XSS, WordPress developers must implement security controls at both the input and output stages.
1. Input Sanitization
All data coming from users should be treated as untrusted. WordPress provides several functions for sanitizing different types of data:
sanitize_text_field(): Strips tags, line breaks, and extra whitespace.sanitize_email(): Removes invalid characters from email addresses.absint(): Ensures a value is a non-negative integer.sanitize_textarea_field(): Sanitizes multi-line text.
2. Output Escaping
Escaping should happen as late as possible, ideally at the point of output (the "sink"). This ensures the data is safe for the specific context in which it is being rendered:
esc_html(): Escapes HTML for use in the body of a page.esc_attr(): Escapes data for use in HTML attributes.esc_url(): Validates and escapes URLs.wp_kses(): Allows only a specific set of HTML tags and attributes, which is useful when some HTML formatting must be preserved.
3. Securing AJAX Handlers
AJAX handlers, especially those accessible to unauthenticated users (wp_ajax_nopriv_ hooks), require rigorous protection:
- Nonce Verification: Nonces (Number used ONCE) are CSRF tokens that verify a request originated from a trusted source. Developers use
check_ajax_referer()orwp_verify_nonce()to validate these tokens. - Capability Checks: Even if a nonce is valid, the handler should check if the user has the necessary permissions using
current_user_can(). For unauthenticated handlers, this usually means ensuring the action itself is safe for public access and that the inputs are strictly validated.
For further information on securing WordPress plugins, you can consult the WordPress Plugin Handbook's Security section.
Summary
The AutomatorWP plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape log metadata when rendering automation activity logs. This allows an attacker to inject malicious scripts through common interaction points (like webhooks or anonymous automation triggers) which execute when an administrator views the logs in the WordPress dashboard.
Vulnerable Code
/* includes/custom-tables/logs.php:722 */ // Check if not is an associative array if( array_keys( $v ) === range( 0, count( $v ) - 1 ) && ! is_array( $v[0] ) ) { // Implode array values by a comma-separated list $new_value .= $k . ': [ ' . implode( ', ', $v ) . ' ]<br>'; } else { // Display all sub arrays $new_value .= $k . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '<br>'; } } else { $new_value .= $k . ': ' . $v . '<br>'; } --- /* libraries/ct-ajax-list-table/includes/ajax-functions.php:12 */ function ct_ajax_list_table_handle_request() { global $ct_table, $ct_query, $ct_list_table, $ct_ajax_list_items_per_page; // Security check, forces to die if not security passed check_ajax_referer( 'ct_ajax_list_table', 'nonce' ); if( ! isset( $_GET['object'] ) ) { wp_send_json_error(); }
Security Fix
@@ -720,15 +720,17 @@ // Check if not is an associative array if( array_keys( $v ) === range( 0, count( $v ) - 1 ) && ! is_array( $v[0] ) ) { + $v = array_map( 'esc_html', $v ); + // Implode array values by a comma-separated list - $new_value .= $k . ': [ ' . implode( ', ', $v ) . ' ]<br>'; + $new_value .= esc_html( $k ) . ': [ ' . implode( ', ', $v ) . ' ]<br>'; } else { // Display all sub arrays - $new_value .= $k . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '<br>'; + $new_value .= esc_html( $k ) . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '<br>'; } } else { - $new_value .= $k . ': ' . $v . '<br>'; + $new_value .= esc_html( $k ) . ': ' . esc_html( $v ) . '<br>'; } } @@ -20,19 +20,33 @@ wp_send_json_error(); } + // Setup the CT Table $ct_table = ct_setup_table( sanitize_text_field( $_GET['object'] ) ); if( ! is_object( $ct_table ) ) { wp_send_json_error(); } + /** + * Filter capability to check + * + * @param string $capability By default, "manage_options" + * + * @return string + */ + $capability = apply_filters( 'ct_ajax_list_table_' . $ct_table->name . '_capability', 'manage_options' ); + + if( ! current_user_can( $capability ) ) { + wp_send_json_error(); + } + // Setup this constant to allow from CT_List_Table meet that this render comes from this plugin @define( 'IS_CT_AJAX_LIST_TABLE', true );
Exploit Outline
The exploit involves a two-step process: injection and triggering. 1. Injection: An unauthenticated attacker targets a plugin feature that records activity logs from public input, such as a Webhook trigger or an anonymous automation. By sending a crafted payload (e.g., via a POST request to a webhook URL) containing a JavaScript string in one of the data fields, the attacker causes the plugin to save this unsanitized data into the custom logs database table. 2. Triggering: The payload executes when an administrative user visits the AutomatorWP logs page (`/wp-admin/admin.php?page=automatorwp_logs`). The page uses an AJAX handler (`ct_ajax_list_table_request`) to fetch log entries. During rendering, the plugin iterates through the log metadata using `automatorwp_log_array_display()`, which directly appends keys and values to the HTML output without escaping. This results in the stored script running in the administrator's browser session, potentially allowing for session takeover or site configuration changes.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.