Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14281— Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

Quick assessment

Affected
101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Automation Web Platform – Notifications and OTP for WooCommerce 插件及 Advanced Country Code 插件在所有 4.8.6 及更低版本中存在权限提升漏洞。该漏洞源于对公开可访问的 REST 路由 缺乏权限校验，以及 函数中缺少密钥白名单机制。该函数将攻击者可控的 参数直接传入 ，使得调用者能够设置敏感的用户元数据键，例如 和 。这导致未认证的攻击者可以注册一个具有管理员角色的新账户，从而获得对网站的完全管理权限。

CVSS 9.8 · Critical EPSS 0.92% · P60

Affected Version Matrix 1

VendorProduct Version RangeStatus
101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code ≤ 4.8.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14281

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code 0 ~ 4.8.6 -

II. Public POCs for CVE-2026-14281

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14281

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-14281 (1)

IV. Related Vulnerabilities

Same product: Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
Same vendor: 101gen
Same weakness: CWE-269