Description
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
Published: 2026-09-25
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin is vulnerable to privilege escalation in all releases up to 4.8.6. The flaw is caused by missing permission checks on the REST endpoint POST /wp-json/wawp/v1/signup/<op> and by the finish_registration_logic function accepting the wawp_custom_fields parameter without filtering. The attacker can inject meta keys such as wp_capabilities and wp_user_level into update_user_meta, enabling the creation of an account with administrator privileges. Additionally, when OTP verification is enabled the OTP session token is returned in plaintext and any GET request containing that token marks it as verified without checking the OTP code, effectively bypassing the second factor and allowing unauthenticated users to activate an OTP session without inbox or SMS access.

Affected Systems

The affected product is the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin supplied by 101gen for WordPress websites. All plugin versions up to and including 4.8.6 are impacted; newer releases are presumed to contain the fix. The vulnerability is reported for WordPress sites that have the plugin installed and enabled.

Risk and Exploitability

The CVSS base score is 9.8, indicating critical severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote client targeting the publicly exposed REST route. The attacker needs only to send standard HTTP traffic; no special network privileges are required. Exploitation involves sending a crafted POST request to inject arbitrary user meta or retrieving the OTP session token from the response and making an unauthenticated GET request that contains the token to bypass OTP verification, thereby gaining full administrative access to the site.

Generated by OpenCVE AI on September 25, 2026 at 09:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Automation Web Platform plugin to a version newer than 4.8.6 that includes the security fix.
  • If an upgrade cannot be performed immediately, disable or remove the public signup REST endpoint and enforce authentication on user registration, or temporarily deactivate the plugin until the fix is applied.
  • Until the patch is applied, prevent OTP bypass by ensuring the OTP code is validated before marking a token as verified; consider disabling OTP magic link or second‑factor functionalities until the integrity of the OTP flow is restored.

Generated by OpenCVE AI on September 25, 2026 at 09:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L342 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L574 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L477 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L787 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L1002 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L845 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L342 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L574 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L477 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L787 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L1002 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L845 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?reponame=&old=3679350%40automation-web-platform&new=3679350%40automation-web-platform cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=cve cve-icon cve-icon
History

Fri, 25 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared 101gen
101gen automation Web Platform – Notifications And Otp For Woocommerce, Advanced Country Code
Wordpress
Wordpress wordpress
Vendors & Products 101gen
101gen automation Web Platform – Notifications And Otp For Woocommerce, Advanced Country Code
Wordpress
Wordpress wordpress

Fri, 25 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
Title Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

101gen Automation Web Platform – Notifications And Otp For Woocommerce, Advanced Country Code
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-25T10:35:29.383Z

Reserved: 2026-07-01T01:25:57.917Z

Link: CVE-2026-14281

cve-icon Vulnrichment

Updated: 2026-09-25T10:34:49.652Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T07:16:53.540

Modified: 2026-09-25T13:08:26.930

Link: CVE-2026-14281

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T09:30:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management