CVE-2026-14281 (GCVE-0-2026-14281)
Vulnerability from cvelistv5
Published
2026-09-25 06:39
Modified
2026-09-25 10:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| 101gen | Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code |
Version: 0 ≤ 4.8.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T10:34:38.917641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:35:29.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Automation Web Platform \u2013 Notifications and OTP for WooCommerce, Advanced Country Code",
"vendor": "101gen",
"versions": [
{
"lessThanOrEqual": "4.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jiemook"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Automation Web Platform \u2013 Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/\u003cop\u003e` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` \u2014 allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value \u2014 making the OTP step trivially bypassable with no inbox or SMS access required."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T06:39:57.424Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L1002"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L574"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L477"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L787"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L845"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L1002"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L574"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L477"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L787"
},
{
"url": "https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L845"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3679350%40automation-web-platform\u0026new=3679350%40automation-web-platform"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-24T18:05:54.000Z",
"value": "Disclosed"
}
],
"title": "Automation Web Platform \u003c= 4.8.6 - Unauthenticated Privilege Escalation via \u0027wawp_custom_fields\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14281",
"datePublished": "2026-09-25T06:39:57.424Z",
"dateReserved": "2026-07-01T01:25:57.917Z",
"dateUpdated": "2026-09-25T10:35:29.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14281\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-25T10:34:38.917641Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-25T10:34:49.652Z\"}}], \"cna\": {\"title\": \"Automation Web Platform \u003c= 4.8.6 - Unauthenticated Privilege Escalation via \u0027wawp_custom_fields\u0027 Parameter\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jiemook\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"101gen\", \"product\": \"Automation Web Platform \\u2013 Notifications and OTP for WooCommerce, Advanced Country Code\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.8.6\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-24T18:05:54.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L1002\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L342\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L574\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L477\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L787\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L845\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L1002\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L342\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L574\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L477\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L787\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L845\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3679350%40automation-web-platform\u0026new=3679350%40automation-web-platform\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Automation Web Platform \\u2013 Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/\u003cop\u003e` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` \\u2014 allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value \\u2014 making the OTP step trivially bypassable with no inbox or SMS access required.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-09-25T06:39:57.424Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-14281\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-25T10:35:29.383Z\", \"dateReserved\": \"2026-07-01T01:25:57.917Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-09-25T06:39:57.424Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…