CVE-2026-14526 — Wupsales AI Copilot – Content Generator
CRITICALCVE-2026-14526 is a critical-severity (CVSS 9.8) Improper Privilege Management vulnerability in wupsales AI Copilot – Content Generator. Versions up to 1.5.6 are affected; the records list no fixed version yet, so check the vendor advisory below.
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying…
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-14526.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Description
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Affected Products
AI Copilot – Content GeneratorwupsalesDetection & mitigation playbook
Vendor / applianceDetect
Inventory every wupsales AI Copilot – Content Generator deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-14526 (versions up to 1.5.6 are affected). Check the wupsales AI Copilot – Content Generator advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-14526 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.