AI Copilot's Workflow Bug: A WordPress Automation Vulnerability

CVE-2026-14526 carries a CVSS score of 9.8 and needs no login at all. The plugin is AI Copilot - Content Generator, and every version up to and including 1.5.6 is affected. The fix shipped in 1.5.8, and the flaw was disclosed on 7 August 2026. The path to full site takeover runs through a feature the plugin is proud of: its workflow builder, the drag-and-drop tool that lets a site owner chain AI actions together without writing code.

That framing matters, because this isn't a bug in some obscure settings screen. It's a bug in the exact feature that makes the plugin worth installing. A workflow builder lets a user compose action nodes, fetch a post, call an AI model, send an email, create a user, into a sequence that runs with the plugin's own privileges. That's a code-execution surface by design, not by accident. When the route that saves and runs a workflow doesn't check who's calling it, an attacker doesn't need to find a separate exploit chain. They just build a workflow that does what they want and let the plugin execute it as intended.

How the flaw works

The plugin's advisory describes the mechanism directly: it does not properly verify that a user is authorized to perform an action, which makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover. They do this by saving and executing a malicious workflow containing a wp_create_user action node that specifies role=administrator.

Walk through what that actually requires. The plugin exposes a Custom Workflow Route, an endpoint that accepts a workflow definition, a list of action nodes with parameters, and runs it. A legitimate workflow might scrape a page, summarize it with an AI call, then post the summary as a draft. Nothing stops the same route from accepting a workflow whose single node is wp_create_user with a role parameter set to administrator. The route doesn't distinguish between the two. It just executes what it's given.

The authorization gap compounds a second problem. Reporting on the flaw notes that the plugin's nonce is exposed in publicly accessible JavaScript, WAIC_DATA.waicNonce, on any page where the [aiwu-form] shortcode or the plugin's public chatbot appears. A nonce that ships in page source to every visitor isn't a login check. It's a formality the client-side code satisfies automatically, which means the one piece of friction between an anonymous request and a workflow execution never actually asked "should this person be allowed to do this."

That's the part worth sitting with longer than the CVSS number. A save-and-execute endpoint for a general-purpose action engine has to authorize on two axes: who is allowed to save a workflow at all, and, separately, whether the caller has the specific capability each node in that workflow requires. This plugin didn't do either.

Who is affected

Any site running AI Copilot - Content Generator 1.5.6 or earlier is exposed, with no configuration required beyond having the plugin active. Sites where the [aiwu-form] shortcode or the public chatbot renders on a front-end page are the most directly reachable, since that's where the nonce leaks into the page. But the underlying authorization gap is on the route itself, not on the shortcode, so treat any install below 1.5.8 as vulnerable regardless of which front-end pieces are in use.

The CVSS 9.8 score reflects an attack that needs no authentication, no user interaction, and produces the maximum outcome on confidentiality, integrity, and availability. Once an attacker holds an administrator account, they can install a plugin, edit theme files, or drop a web shell through the standard plugin editor. There's no privilege above administrator left to escalate to.

Why node-based automation needs its own security model

Automation and AI plugins keep converging on the same interface: a canvas where users drag nodes onto a workflow and wire them together. Zapier popularized it outside WordPress, and inside WordPress a growing set of AI plugins, chatbot builders, and content pipelines have adopted it because it's genuinely useful. A non-developer can compose "when a form submits, summarize it with AI, then email the summary" without touching code.

But that convenience comes from a specific tradeoff: the plugin ships a catalogue of action nodes, and each node is really a thin wrapper around a WordPress function or API call. wp_create_user, update_option, wp_insert_post, an HTTP request to an external service. Put differently, the node catalogue is a capability list. Whatever functions the plugin's developers decided to expose as nodes are the functions an attacker can reach if the save-and-execute path isn't gated. A plugin with twelve action nodes has quietly defined twelve things an unauthenticated user might get to do, unless the execution layer enforces otherwise.

The design mistake in CVE-2026-14526 is that execution inherited the plugin's own privileges instead of the calling user's. WordPress core doesn't make that mistake with user creation. Creating a user with the administrator role requires the create_users and promote_users capabilities, checked against the actual logged-in user, every time, regardless of which code path triggers the request. Core treats user creation as a capability-gated action, not a data write that any authenticated (or unauthenticated) request can trigger by hitting the right function.

A workflow engine has to reproduce that same discipline at two separate points, and skipping either one is enough to fail. First, saving a workflow needs to check that the caller is allowed to author workflows at all. Second, and this is the part that's easy to skip because it feels redundant, executing a workflow needs to check that the caller holds the specific capability each node in it requires. A user with edit_posts shouldn't be able to save a workflow that calls wp_create_user, even if they're a real logged-in author, because their own capabilities don't extend to creating administrators. When neither check exists, and the caller isn't even authenticated, the entire node catalogue becomes reachable in one request.

This pattern isn't unique to this plugin. Aimogen Pro's CVE-2026-15982, disclosed in July 2026, had a missing capability check on a function-calling entry point that let attackers use an aimogen_wp_god_mode tool to clear the plugin's function blacklist and reach its full internal function set. A separate post covers that one in depth, but the shape is the same lesson twice: an execution engine built to run privileged actions on a user's behalf is only as safe as the check standing between "anyone can call this" and "only someone with the right capability can."

Here's the difference in code terms, generic and not tied to this plugin's actual source, between a workflow endpoint that only checks a nonce and one that checks the caller's capability per node:

// Nonce-only: proves the request came from our JS, not that the caller may do this.
function handle_workflow_execute( $request ) {
    check_ajax_referer( 'waic-nonce', 'nonce' );
    return run_workflow( $request['nodes'] );
}
// Capability-gated: checks each node's required capability against the caller.
function handle_workflow_execute( $request ) {
    check_ajax_referer( 'waic-nonce', 'nonce' );
    foreach ( $request['nodes'] as $node ) {
        if ( ! current_user_can( $node['required_cap'] ) ) {
            return new WP_Error( 'forbidden', 'No permission' );
        }
    }
    return run_workflow( $request['nodes'] );
}

The nonce check alone answers "did this request come from our JavaScript." It never answers "is this specific user allowed to create an administrator." That second question is the one a node-based automation tool has to ask on every execution, not just at save time, because a workflow saved by one process can still be triggered by another.

If you build or review WordPress plugins with an action-node catalogue, chatbot function calling, or a visual automation canvas, this is the concrete audit question: for every node in the catalogue, what WordPress capability does it require, and does the execution path check that capability against the actual caller before running it? If the answer is "we check a nonce and call it done," the node catalogue is an open door with a doorbell on it.

What to do now

Update AI Copilot - Content Generator to 1.5.8 or later immediately. That's the fixed version, and there's no safe workaround for sites that need to stay on 1.5.6 while keeping the workflow builder active, since the flaw sits in the route itself rather than in a feature you can toggle off.

Because successful exploitation leaves a rogue administrator account behind, check your Users list for accounts you don't recognize, paying attention to any created around or after your site's exposure window and any with the administrator role that nobody on your team remembers adding. Cross-reference creation timestamps against your team's actual onboarding activity. If you find one, don't just delete it: also check the Plugins and Appearance > Theme Editor screens for anything installed or modified after that account's creation date, since an attacker holding admin access for even a few minutes has enough runway to drop a persistent backdoor separate from the account itself.

Review any saved workflows in the plugin for nodes you didn't create, particularly ones referencing wp_create_user or other user-management actions. Rotate WordPress salts and any API keys the plugin stores if you find evidence of unauthorized workflow execution in your logs. For the broader question of what an intrusion looks like beyond a single suspicious account, this checklist for spotting a hacked WordPress site walks through the other indicators worth checking, backdoor files, unexpected cron jobs, outbound connections.

If you're evaluating AI plugins generally rather than responding to this specific CVE, our WordPress AI plugin security checklist covers the broader review process, and this piece on AI-generated plugin code risk looks at a related but distinct problem: code quality in plugins that were themselves written by AI tools. WP Vanguard scans for exposed admin-creation paths and missing capability checks like this one as part of its regular plugin surface scans.

References

• CVE Record: CVE-2026-14526
• NVD - CVE-2026-14526 Detail
• CVE-2026-14526 | THREATINT
• CVE-2026-14526 | HackTesting
• Critical Authorization Bypass Flaw (CVE-2026-14526) Exposes WordPress Sites via AI Copilot - Content Generator Plugin, Brinztech
• CVE-2026-15982: Improper Privilege Management in Aimogen Pro, OffSeq Threat Radar