CVE-2026-14281 affects the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin versions up to 4.8.6. The vulnerability arises from missing permission enforcement on the publicly accessible REST endpoint `POST /wp-json/wawp/v1/signup/<op>`, and the lack of a key allowlist in the `finish_registration_logic` function. This function copies attacker-controlled `wawp_custom_fields` directly into `update_user_meta()`, enabling attackers to set sensitive meta keys such as `wp_capabilities` and `wp_user_level`. Consequently, unauthenticated attackers can create accounts with administrator roles. Furthermore, when OTP verification is enabled, the OTP session token (`otp_transient`) is returned in plaintext in HTTP responses, and the `handle_magic_link_request()` handler marks the token as verified on any unauthenticated GET request containing it without validating the OTP code, allowing trivial bypass of OTP verification.

An unauthenticated attacker can exploit this vulnerability to create a new user account with administrator privileges, gaining full control over the affected WordPress site. The OTP verification bypass further facilitates this by allowing attackers to bypass the OTP step without access to the victim's inbox or SMS. This leads to complete compromise of confidentiality, integrity, and availability of the site.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the vulnerable plugin or restrict access to the affected REST endpoints if possible. Monitor vendor communications for updates and apply patches promptly once released.