{"id":"CVE-2026-14526","state":"PUBLISHED","title":"AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route","description":"The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.","publishedAt":"2026-08-08T06:38:41.550Z","updatedAt":"2026-08-11T01:23:48.203Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Wordfence"},"assigner":"Wordfence","products":["wupsales AI Copilot – Content Generator"],"affected":[{"vendor":"wupsales","product":"AI Copilot – Content Generator","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.5.6","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/e28ae1a3-abc6-484c-abc7-1e0b958fa30b?source=cve","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L39","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L86","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/blocks/actions/wp_create_user.php#L107","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/frame.php#L211","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/assets.php#L96","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/forms/views/forms.php#L87","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L39","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L86","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/blocks/actions/wp_create_user.php#L107","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/frame.php#L211","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/assets.php#L96","https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/forms/views/forms.php#L87"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/14xxx/CVE-2026-14526.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14526","state":"PUBLISHED","datePublished":"2026-08-08T06:38:41.550Z","dateUpdated":"2026-08-11T01:23:48.203Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2026-07-02T20:10:14.061Z"},"containers":{"cna":{"title":"AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route","descriptions":[{"lang":"en","value":"The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier."}],"affected":[{"vendor":"wupsales","product":"AI Copilot – Content Generator","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.5.6","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28ae1a3-abc6-484c-abc7-1e0b958fa30b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L39"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L86"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/blocks/actions/wp_create_user.php#L107"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/frame.php#L211"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/assets.php#L96"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/forms/views/forms.php#L87"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L39"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L86"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/blocks/actions/wp_create_user.php#L107"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/frame.php#L211"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/assets.php#L96"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/forms/views/forms.php#L87"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","lang":"en","description":"CWE-269 Improper Privilege Management","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-08-08T06:38:41.550Z"},"credits":[{"lang":"en","type":"finder","value":"d.v4n_s3c"}],"timeline":[{"time":"2026-08-07T18:30:06.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-11T01:23:32.869783Z","id":"CVE-2026-14526","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-11T01:23:48.203Z"}}]}}}