CVE-2026-14526: The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to…

Summary

The AI Copilot – Content Generator WordPress plugin, in all versions up to and including 1.5.6, fails to verify user authorization. Unauthenticated attackers can save and run a malicious workflow containing a wp_create_user action node with role=administrator, creating an administrator account and taking over the site. The waic-nonce value is emitted into public JavaScript (WAIC_DATA.waicNonce) on pages where the [aiwu-form] shortcode or public chatbot is rendered, so the nonce check provides no real barrier. Any site rendering those components on a frontend page is exposed.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Coding assistants

Related items

• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek
• MediumMalicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersSimilar attack · The Hacker News
• LowRailway’s AI agents go off the track on a rival’s networkSimilar attack · CSO Online
• MediumOpenAI Model Wrote Its Own Network Code to Get Around Sandbox RestrictionsSimilar attack · SecurityWeek
• MediumChainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key ServicesSimilar attack · The Hacker News