SYS::ONLINE
Wasteland.
Briefs1775
Issues22
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-14526 2026-08-08

CVE-2026-14526: Unauthenticated Site Takeover in WordPress "AI Copilot – Content Generator"

"A critical authorization bypass in the AI Copilot – Content Generator plugin for WordPress lets unauthenticated attackers create administrator accounts and fully take over affected sites."

A critical authorization bypass in the AI Copilot – Content Generator plugin for WordPress lets unauthenticated attackers create administrator accounts and fully take over affected sites.

What Is It

CVE-2026-14526 is an authorization bypass (CWE-269, Improper Privilege Management) in the AI Copilot – Content Generator plugin for WordPress, published to NVD on 2026-08-08 and reported by Wordfence. The plugin fails to properly verify that a user is authorized to perform an action before executing it.

The practical result is that an unauthenticated attacker can save and execute a malicious workflow containing a wp_create_user action node with role=administrator, creating a new administrator-level account and achieving full site takeover.

The barrier that was supposed to prevent this, a nonce check, is non-functional in the exposed scenario. The waic-nonce value is emitted into publicly accessible JavaScript as WAIC_DATA.waicNonce on any frontend page that renders the [aiwu-form] shortcode or the public chatbot, so an attacker can simply read it from the page source.

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That combination is the worst case: network-reachable, low attack complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Administrator creation on a WordPress instance is effectively full compromise; content, credentials, plugin code execution, and persistence all follow.

Note the exposure condition: the flaw is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or the public chatbot is rendered on a frontend page. That is the intended, common deployment of the plugin, not an edge case.

What's Vulnerable

The supplied data references vulnerable code paths in both the 1.5.4 and 1.5.6 tags, including modules/workflow/controller.php, modules/workflow/blocks/actions/wp_create_user.php, and classes/assets.php.

Patch Status

The supplied NVD record lists no fixed version and no vendor advisory; 1.5.6 is still marked affected, and the CVE status is "Received." No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or KEV-mandated remediation deadline in this source material. No specific required action is stated in the supplied data.

Sources