CVE-2026-14281

9.8 CRITICAL

Published 2026-09-25 · Updated 2026-09-25

AI risk analysis

Summary: The flaw allows unauthenticated attackers to escalate privileges by exploiting a missing permission enforcement and a lack of key allowlist, leading to the ability to register an account with administrator role and gain full administrative access.
Exploitability: Exploitation is relatively straightforward as it requires sending a POST request to a publicly accessible REST route without any authentication preconditions.
Blast radius: If exploited, the impact is severe as it grants full administrative access to the site, potentially leading to data breaches, unauthorized changes, and complete control over the WordPress site.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable the affected feature or upgrade to version 4.8.7 or later.

auth-bypasspriv-escalationwebwp

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.