CVE-2026-14281
Received Received - Intake

Privilege Escalation in Automation Web Platform Notifications and OTP for WooCommerce

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-14281
EUVD
EUVD-2026-86548

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce advanced_country_code_plugin to 4.8.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows unauthenticated attackers to register as administrators by exploiting missing permission checks and direct user meta updates. Attackers can set sensitive roles like 'wp_capabilities' via a REST route, gaining full site control. OTP verification is also bypassed due to plaintext token exposure and improper validation.

Detection Guidance

Check WordPress sites for unauthorized admin accounts by reviewing user roles in the database or WordPress admin panel. Inspect HTTP responses for plaintext OTP tokens in the /wp-json/wawp/v1/signup/ route. Monitor for suspicious REST API calls to the vulnerable endpoint.

Impact Analysis

If you use this plugin, attackers can take over your WordPress site, steal data, install malware, or deface content. They gain admin access without needing credentials or OTP codes, compromising the entire site and potentially affecting visitors.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive user data. A site breach could lead to regulatory fines, legal liabilities, and reputational damage due to non-compliance with data protection requirements.

Mitigation Strategies

Immediately update the Automation Web Platform – Notifications and OTP for WooCommerce plugin to the latest version. Disable the plugin if no update is available. Remove any unauthorized admin accounts and audit user roles. Block public access to the vulnerable REST route via .htaccess or firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart