The short version

AutomatorWP sells every one of its paid add-ons for $149 a year across two WordPress sites. Uncanny Automator's cheapest plan, the Legacy Basic tier, is $199 a year for one. That gap is the whole case for AutomatorWP, and it is a real one: the free plugin on wordpress.org already lists more than 600 triggers, actions and filters across 200+ plugins and platforms, with no task credits and no monthly run cap, because every automation runs on your own server.

The case against it is a list of twelve CVE numbers. Between December 2024 and August 2026 the National Vulnerability Database published twelve advisories for this plugin, seven rated HIGH or CRITICAL. All of them are fixed in the current 6.0.x line. That record changes what you are actually paying $149 for, and it is the reason this review spends more time on licensing than on the feature list.

Try AutomatorWP

What the free plugin does

AutomatorWP is built by Sweet Code Chef SL, the Alicante company behind the GamiPress gamification plugin, and it works the way WordPress users expect. You pick a trigger from one plugin (a WooCommerce purchase, a form submission, a LearnDash lesson completed), attach one or more actions in another (add a tag in your CRM, enrol the user in a course, send an email), and optionally put filters on either side. The listing promises unlimited triggers and actions, loop automations, sequential triggers, completion limits per user and globally, and tags that carry trigger data, including user and post meta, into the actions.

The free core, and the free add-ons, run on as many sites as you like. What the free tier leaves out matters more than the headline count. The Webhooks add-on is paid, and it is the only route to anything outside WordPress: Zapier, Make, IFTTT, Integrately, KonnectzIT, or any REST API. Delays are paid too, through the Schedule Actions add-on. So "send a follow-up email three days after purchase" and "push this form entry to a Google Sheet via Zapier" both need a licence.

That is also the recurring complaint in the plugin's low ratings. The most-cited one-star review on wordpress.org is titled "Out of the box is doesn't do much for the free version". It is about three years old and there are only three one-star ratings out of 201, but the point stands for anyone who needs webhooks or delays. The five-star reviews come from people whose automations stay inside WordPress: one user in January 2026 wrote that they could build "quite complicated automations with the available free options, which are impossible to make with other plugins."

Four kinds of automation, not one

Most WordPress automation plugins only react to a logged-in user doing something. AutomatorWP splits automations by who they run for, and the split is the most useful thing in its documentation.

Logged-in automations are the standard kind. Anonymous automations handle visitors who are not logged in and can create a new user or attach the event to an existing one, which is how a guest checkout or a public form becomes an account. All users and All posts automations run across your whole user or post table, either on demand or on a date or a recurring schedule, so "every Monday, email users whose membership expires this week" is one automation rather than a cron job. The docs menu also lists Import File (CSV), All Users In List and Restrict Content types. What the docs never say is which of these types need a paid add-on, so check the add-on page for the one you need before building around it.

A small feature worth knowing about: automations can be exported and imported through a URL instead of a file, provided you are logged in on the target site. It is handy for agencies copying a setup between client sites. It is also the endpoint behind one of the worst CVEs below.

The AI Assistant in version 6.0

Version 6.0.0 shipped this year with a changelog line reading "Added the AI Assistant!!!". The wordpress.org screenshot caption calls it "ready to help you design, create and manage your automations". The listing's own small print is the part to read: "This assistant uses the WP AI Connectors. Without a configured connector, it won't be able to perform any tasks."

In practice that means the assistant is a front end, not a model. You bring the AI provider and its API key through WordPress's AI Connectors, and you pay that provider for every request. If you want AI sold as part of the plan instead, Uncanny Automator's AI + Automation tier does that, at roughly double the price.

Pricing, renewals and refunds

Checked on automatorwp.com/pricing on September 28, 2026. Every pass includes all add-ons under one licence key, one year of support and updates per year paid, and there is no lifetime plan. The page was last modified in April 2025, so these figures have held for well over a year.

The vendor labels the multi-year terms "Save 20%" and "Save 40%", and on the Personal pass the arithmetic holds: $88 saved over three years, $296 over five, against paying $149 each year. There is one inconsistency the vendor has not resolved. The multi-year cards say "billed every 3 years" and "billed every 5 years", while the licensing FAQ on the same page says keys "will automatically renew every year". Ask before paying for a five-year term.

Add-ons are also sold singly. The Webhooks add-on costs $49 for two sites, $89 for ten and $129 unlimited. Two single add-ons already cost about what the Personal pass does, so the pass is the sensible buy for almost anyone who needs more than one.

Refunds are at the vendor's "sole discretion" and only within 14 days of a purchase or a renewal, after you deactivate and uninstall the software. Prices "are subject to change without prior notice".

What happens when the licence lapses

This is the clause that matters most. The FAQ says: "If you decide to cancel, you may still use the add-on but you will not receive updates or support once the license key expires." Your automations keep running. On most plugins that would be generous. On one with seven HIGH or CRITICAL advisories in 20 months, it means a lapsed licence leaves paid add-on code on your site that stops receiving fixes. Free support also covers the core only; help with a premium add-on needs a valid key.

The security record

These are the advisories NVD lists for AutomatorWP, with NVD's publish date and CVSS score. Patchstack keeps its own list and dates some of them earlier.

CVE-2025-9539 is the one to understand. An automation plugin's whole job is to take actions on your site, and this bug let any logged-in Subscriber, the role every open registration form hands out, create automations of their choosing through the import-from-URL feature. On a membership site or a WooCommerce store, that is every customer.

The fair reading: fixes ship fast. The changelog shows "Fixed vulnerability" entries in 5.1.0, 5.2.5, 5.2.6, 5.3.7, 5.3.8, 5.6.8, 5.8.4 and 5.8.5, and users in the reviews praise how quickly problems are patched. The less comfortable reading is that those entries never name the CVE they close, so you cannot tell from the changelog which update was urgent. Every advisory above affects 5.8.4 or earlier; version 6.0.2, released September 14, 2026, is past all of them. Turn on auto-updates for this plugin and keep the licence current if you use paid add-ons.

AutomatorWP vs Uncanny Automator

Uncanny Automator's live pricing page blocked us, so these figures come from the archived page (August 15, 2026) used in our Uncanny Automator review. Like for like on the recipes-only Legacy plans, AutomatorWP costs $149 for two sites against Uncanny's $199 for one, and $249 for ten sites against $349. Uncanny's current plans with AI start at $300 a year for a single site.

What the extra money buys at Uncanny is mainly its AI tier. Neither vendor has a clean 2026: Uncanny shipped a backdoored Pro update in June, AutomatorWP had three HIGH advisories the same month. AutomatorWP's logs screen, which records who completed each automation and when, is at least a straightforward place to check what has been running on your site.

Verdict

Buy it if you run two to ten WordPress sites and want every add-on, webhooks and delayed actions included, for the lowest yearly price in this category and with no task credits to count. Start with the free plugin: if your automations never leave WordPress, you may never need to pay. If you do, the 14-day refund window is short, so test the add-on you actually need in that first fortnight.

Skip it if you want AI included in the price rather than wired up to your own provider; Uncanny Automator sells that, for about twice the money. Skip it too if your automations are mostly between SaaS apps rather than WordPress plugins: Zapier, n8n or Activepieces run outside your server and do not add PHP code to it. And if you would let the licence lapse and forget the updates, remember that this plugin collected twelve advisories in twenty months.

Try AutomatorWP