Critical 9.8

CVE-2026-14281

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/op` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()`, allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. T…

Scores

CVSS out of 10, critical severity.

EPSS chance of exploitation in the next 30 days.

The facts

Published

25 September 2026

Last changed

25 September 2026

NVD status

Deferred

Severity

Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness

Improper privilege management (CWE-269)

Known exploited

Not in the CISA Known Exploited Vulnerabilities catalogue in this build.

EPSS

0.5% chance of exploitation activity in the next 30 days (percentile 44).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

Scores

The facts

Is there a Securelyn advisory?

References