{"data":{"id":"ebb5dbdb-d4ce-4280-ba17-7889609091a9","title":"CVE-2026-14526: The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and","summary":"The AI Copilot – Content Generator plugin for WordPress (versions up to 1.5.6) has a security flaw where it doesn't properly check if users are authorized to perform actions. An attacker who is not logged in can exploit this by using a publicly visible security token (nonce, a temporary code meant to prevent unauthorized actions) to create a new admin account and take over the entire website, as long as the plugin's form or chatbot is visible on the site's public pages.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14526","publishedAt":"2026-08-08T07:17:08.297Z","cveId":"CVE-2026-14526","cweIds":["CWE-269"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["AI Copilot – Content Generator"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-08T07:17:08.297Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}