Attack Chain

1. Attacker navigates to a public-facing WordPress page that utilizes the [aiwu-form] shortcode or the plugin's public chatbot interface.
2. Attacker inspects the source code of the page to locate the WAIC_DATA.waicNonce value within the rendered JavaScript.
3. Attacker constructs a malicious workflow request intended for the plugin's backend endpoint.
4. Attacker inserts a wp_create_user action node into the workflow, configuring the payload to set the role parameter to administrator.
5. Attacker transmits the crafted request to the WordPress site, including the extracted waic-nonce to bypass the authentication check.
6. The plugin processes the workflow engine request, executing the wp_create_user function with the attacker-supplied parameters.
7. A new administrative user is created within the WordPress database.
8. Attacker authenticates with the newly created account to establish persistent, full-access administrative control over the site.

Impact

Successful exploitation results in full site takeover. An attacker can gain persistent administrative access, leading to the exfiltration of sensitive site data, modification of site content, redirection of users to malicious infrastructure, or use of the server as a node for further attacks.

Recommendation

• Immediately update the "AI Copilot - Content Generator" plugin to a version later than 1.5.6 to patch the authorization bypass vulnerability (CVE-2026-14526).
• If the update cannot be applied, disable the plugin and remove any pages containing the [aiwu-form] shortcode or the public chatbot interface.
• Audit the WordPress database for suspicious administrative accounts created by unknown sources, specifically monitoring user registration logs for entries generated via the plugin's backend logic.
• Review web server logs for HTTP POST requests to plugin-specific workflow endpoints that contain wp_create_user payloads.