CVE-2026-14281

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7

Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST /wp-json/wawp/v1/signup/<op> and the absence of a key allowlist in the finish registration logic() function. This allows the wawp custom fields parameter to be copied directly into update user meta(), enabling unauthenticated attackers to set sensitive meta keys such as wp capabilities and wp user level to grant themselves the administrator role and gain full site access. Additionally, when OTP verification is enabled during signup, the otp transient session token is returned in plaintext in the HTTP response body. The handle magic link request() handler marks this token as verified upon any unauthenticated GET request containing it, bypassing the OTP code verification process entirely.

Recommendations Update Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress to a version newer than 4.8.6.