CVE-2026-14281 101gen CVE debrief

Who should care

WordPress administrators, security teams, and IT professionals responsible for maintaining and securing WordPress installations should assess exposure and prioritize verification of current security controls.

Why it matters

CVE-2026-14281 allows unauthenticated attackers to gain full administrative access to WordPress sites using the vulnerable Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin. Defenders should verify exposure, assess security controls, and prioritize updates to prevent exploitation.

• Unauthenticated attackers can register a new account with the administrator role
• Attackers can gain full administrative access to the site
• The OTP step can be trivially bypassed with no inbox or SMS access required
• Verification of plugin version and security controls is necessary

Technical summary

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP is

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin, versions up to and including 4.8.6, and assess the effectiveness of current security controls.

Recommended defensive actions

• Verify WordPress installations for the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin version 4.8.6 or earlier
• Assess the effectiveness of current security controls and configurations
• Implement additional security measures to restrict access to sensitive areas of the site
• Monitor for suspicious activity and update the plugin to a patched version as soon as available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.