POCBIT
Log inSign up

CVE-2026-14281 — WAWP WordPress Unauthenticated Privilege Escalation (≤ 4.8.6)

Unauthenticated administrator via public WAWP REST signup: unsanitized wawp_custom_fields writes wp_capabilities through update_user_meta. Automation Web Platform plugin ≤ 4.8.6 (CVSS 3.1 9.8 Critical).

#wordpress#plugin#wawp#automation-web-platform#privilege-escalation#rest-api#unauthenticated

CVE:

CVE-2026-14281

Date:

2026-09-25

Severity:

CRITICAL

Exploit source

PoC code is available to registered members only.

Log inSign up

Description

Overview

CVE-2026-14281 is an unauthenticated privilege escalation in the WordPress plugin Automation Web Platform (WAWP — Notifications & OTP for WooCommerce, slug automation-web-platform).

The public REST signup endpoint accepts wawp_custom_fields, maps it to custom_fields_data, and after wp_insert_user() persists each key with update_user_meta() without an allowlist. An attacker can set wp_capabilities and wp_user_level to obtain administrator access.

Affected versions

| | | |---|---| | Affected | ≤ 4.8.6 | | Fixed in | > 4.8.6 (upgrade to latest stable from WordPress.org) | | CVSS 3.1 | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) | | Vector | POST /wp-json/wawp/v1/signup/signup (unauthenticated) |

Plugin directory: Automation Web Platform on WordPress.org.

Technical notes

Relevant code paths (4.8.6):

  • includes/api/class-wawp-rest-settings-api.php — signup route registration
  • includes/auth-services/class-wawp-otp-service.php — wawp_custom_fields → custom_fields_data
  • includes/auth-services/class-wawp-signup.php — finish_registration_logic

OTP caveat: If signup OTP is enabled, the first request may stop at otp_verify (challenge sent) and full registration completes only after OTP validation. The bundled PoC reports otp_required in that case; one-shot unauth admin may require OTP disabled or a separate bypass.

Bundled PoC (PoCbit download)

Python 3 tool with check and exploit modes:

  • check — Plugin/version fingerprint, WAWP REST namespace, optional live signup probe (may create a throwaway user when OTP is off).
  • exploit — Registers a user with injected capability meta (authorized targets only); --verify attempts wp-admin login confirmation.

Mass scan: --list targets.txt --mode check --threads 20. Use only on hosts you own or have written authorization to test.

Impact

Full site compromise as WordPress administrator: plugin/theme install, user management, content tampering, and lateral movement from the CMS.

Remediation

  1. Upgrade Automation Web Platform to a version newer than 4.8.6.
  2. Block or rate-limit unauthenticated access to /wp-json/wawp/v1/signup/* at the WAF if you cannot patch immediately.
  3. Audit recently created users and wp_usermeta for suspicious wp_capabilities changes.
  4. Disable public signup if the feature is not required.

Legal and ethical use

Unauthorized exploitation of WordPress sites is illegal in most jurisdictions. This entry is for defensive verification and authorized penetration testing.

References