CVE-2026-14526 in AI Copilot Plugin
Summary
by MITRE • 08/08/2026
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
The vulnerability in the AI Copilot - Content Generator plugin for WordPress represents a critical authorization bypass flaw that undermines fundamental security controls within the platform. This issue affects all versions up to and including 1.5.6, creating a pathway for unauthenticated attackers to escalate privileges and gain complete control over affected websites. The core problem stems from the plugin's failure to properly validate user permissions before executing sensitive operations, effectively removing the authorization checks that should prevent unauthorized access to administrative functions. Such a flaw directly violates the principle of least privilege and demonstrates poor implementation of access control mechanisms within the WordPress ecosystem.
The technical exploitation of this vulnerability occurs through the manipulation of the plugin's frontend interfaces, specifically targeting pages that contain either the [aiwu-form] shortcode or public chatbot functionality. Attackers can leverage the exposure of the waic-nonce value in publicly accessible JavaScript code, which is made available through the WAIC_DATA.waicNonce variable. This nonce value, which should normally serve as a time-limited token to verify legitimate requests, becomes ineffective when exposed to unauthenticated users. The vulnerability allows attackers to craft and execute malicious workflows that include a wp_create_user action node with role=administrator, enabling them to create new administrator accounts without proper authentication. This pattern aligns with common attack vectors described in the ATT&CK framework under privilege escalation techniques where attackers exploit weak session management and insufficient input validation.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables complete site takeover capabilities for unauthenticated threat actors. Once an attacker successfully creates an administrator account through this method, they gain unrestricted access to all website features, including the ability to modify content, install malicious plugins, alter user permissions, and potentially use the compromised site for further attacks against visitors or other systems. The exposure of the nonce value in client-side JavaScript represents a fundamental flaw in how the plugin handles authentication tokens, making it particularly dangerous as it eliminates any meaningful authorization barrier. This vulnerability is especially concerning because it requires no prior credentials or authenticated access to exploit, making it a prime target for automated attacks and widespread compromise across multiple WordPress installations.
Security mitigations for this vulnerability should focus on immediate remediation through plugin updates to versions that properly implement authorization checks and eliminate the exposure of authentication tokens in frontend JavaScript. Organizations should also consider implementing additional monitoring for unusual user creation activities and review their WordPress security configurations to ensure proper nonce handling. The vulnerability demonstrates the critical importance of server-side validation of all user actions, regardless of whether they originate from authenticated or unauthenticated sources, as outlined in CWE-863 (Incorrect Authorization) and related access control standards. Regular security audits of WordPress plugins should include verification that authentication tokens are properly protected and that sensitive operations require proper authorization checks before execution.