{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14526","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-07-02T20:10:14.061Z","datePublished":"2026-08-08T06:38:41.550Z","dateUpdated":"2026-08-08T06:38:41.550Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-08-08T06:38:41.550Z"},"affected":[{"vendor":"wupsales","product":"AI Copilot – Content Generator","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.5.6","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier."}],"title":"AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28ae1a3-abc6-484c-abc7-1e0b958fa30b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L39"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/controller.php#L86"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/workflow/blocks/actions/wp_create_user.php#L107"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/frame.php#L211"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/classes/assets.php#L96"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.6/modules/forms/views/forms.php#L87"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L39"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/controller.php#L86"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/workflow/blocks/actions/wp_create_user.php#L107"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/frame.php#L211"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/classes/assets.php#L96"},{"url":"https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.5.4/modules/forms/views/forms.php#L87"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-269 Improper Privilege Management","cweId":"CWE-269","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}}],"credits":[{"lang":"en","type":"finder","value":"d.v4n_s3c"}],"timeline":[{"time":"2026-08-07T18:30:06.000Z","lang":"en","value":"Disclosed"}]}}}