Executive Summary

A critical vulnerability (CVE-2026-14526) has been discovered in the AI Copilot – Content Generator plugin for WordPress. This vulnerability allows unauthenticated attackers to bypass authorization and create new administrator-level user accounts, potentially leading to full site takeover. The vulnerability affects all versions up to and including 1.5.6.

Technical Analysis

The vulnerability is caused by the plugin's failure to properly verify user authorization for certain actions. Specifically, the plugin does not correctly validate that a user is authorized to perform actions, making it possible for unauthenticated attackers to execute malicious workflows. The vulnerability is particularly severe because the waic-nonce value, intended to serve as a security barrier, is emitted into publicly accessible JavaScript on pages where the [aiwu-form] shortcode or public chatbot is rendered.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by saving and executing a malicious workflow containing a wp_create_user action node with role=administrator. This can be done by accessing a frontend page where the [aiwu-form] shortcode or public chatbot is rendered. The attacker can then create a new administrator-level user account, achieving full site takeover.

Impact Assessment

The impact of this vulnerability is severe. An attacker can create a new administrator-level user account, allowing them to gain full control over the WordPress site. This can lead to unauthorized access, data breaches, and other malicious activities. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. All versions of the AI Copilot – Content Generator plugin up to and including 1.5.6 are affected.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the AI Copilot – Content Generator plugin to version 1.5.7 or later as soon as possible. Additionally, users should review their site's workflows and user accounts for any suspicious activity. Implementing a Web Application Firewall (WAF) rule to block suspicious traffic and monitoring for indicators of compromise (IoCs) can also help detect and prevent exploitation.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence