CVE-2026-14526 is an improper privilege management vulnerability (CWE-269) in the AI Copilot – Content Generator WordPress plugin. The plugin fails to properly verify that a user is authorized to perform privileged actions, specifically allowing unauthenticated attackers to create new administrator accounts by submitting malicious workflows containing a wp_create_user action node with role=administrator. The vulnerability is exploitable on any site rendering the [aiwu-form] shortcode or public chatbot on frontend pages because the waic-nonce value is exposed in publicly accessible JavaScript (WAIC_DATA.waicNonce), rendering the nonce check ineffective as an authorization barrier. This results in a critical security risk with a CVSS 3.1 base score of 9.8, indicating network attack vector, low attack complexity, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.

Successful exploitation allows unauthenticated attackers to create new administrator-level accounts on affected WordPress sites, leading to complete site takeover. This includes full control over site content, configuration, and user management, posing a critical risk to confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable the use of the [aiwu-form] shortcode and public chatbot on frontend pages to prevent exposure of the waic-nonce value. Monitor for updates from the vendor wupsales regarding patches or official mitigations.