CVE-2025-9539: 
WordPress vulnerability analysis and mitigation

The AutomatorWP WordPress plugin versions up to and including 5.3.6 contains a missing authorization vulnerability that affects the automatorwpajaximportautomationfrom_url function. This vulnerability was discovered on September 8, 2025, and has been assigned CVE-2025-9539 with a CVSS score of 8.0 (High) (Tenable CVE, Wordfence Intel).

The vulnerability exists due to a missing capability check in the automatorwpajaximportautomationfrom_url function, which allows authenticated users with Subscriber-level access or higher to create arbitrary automations. The affected code is located in the import-automation.php file, where the AJAX action hook is registered without proper authorization checks (Plugin Source).

When exploited, this vulnerability allows authenticated attackers with Subscriber-level access to create arbitrary automations, which can potentially lead to Remote Code Execution (RCE) or privilege escalation once such automation is activated by an administrator (Tenable CVE).

Website administrators running affected versions of the AutomatorWP plugin should update to a version newer than 5.3.6 as soon as possible. Until an update can be applied, it is recommended to review and potentially revoke Subscriber-level access to untrusted users (Tenable CVE).