CVE-2026-14526 is an authorization bypass vulnerability (CWE-269) in the AI Copilot – Content Generator WordPress plugin versions up to 1.5.6. The plugin fails to properly verify user authorization before performing sensitive actions. Specifically, the waic-nonce value used for authorization is exposed in frontend JavaScript (WAIC_DATA.waicNonce) on pages rendering the [aiwu-form] shortcode or public chatbot, making the nonce ineffective as a security barrier. This allows unauthenticated attackers to execute a malicious workflow containing a wp_create_user action node with role=administrator, thereby creating a new admin user and achieving full site takeover.

Successful exploitation results in full site compromise, including the ability to create administrator-level accounts without authentication. This leads to complete control over the affected WordPress site, including potential data theft, site defacement, or further malicious activity. The vulnerability has a CVSS 3.1 base score of 9.8 (critical), reflecting its high impact and ease of exploitation over the network without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the AI Copilot – Content Generator plugin if it is not essential. Additionally, avoid rendering the [aiwu-form] shortcode or public chatbot on publicly accessible frontend pages to prevent exposure of the waic-nonce value. Monitor vendor channels for updates and apply patches promptly once released.