WordPress Plugin Privilege Escalation via Unvalidated REST API

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET reques

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Automation Web Platform – Notifications and OTP for WooCommerce plugin contains a critical privilege escalation vulnerability affecting all versions up to 4.8.6. The vulnerability exists in the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>`, which lacks proper permission enforcement and fails to validate the `wawp_custom_fields` parameter before passing it directly to WordPress's `update_user_meta()` function. This allows unauthenticated attackers to modify arbitrary user metadata, potentially elevating their privileges to administrator level or manipulating user accounts without authorization. With a CVSS score of 9.8, this impacts any WordPress installation using this plugin, affecting e-commerce platforms, notification systems, and user authentication workflows that rely on this extension.

Casky.ai's security skills mapped to MITRE ATT&CK Technique TA0004 (Privilege Escalation) would detect this vulnerability through multiple analytical vectors. The 224 matching skills enable practitioners to identify: (1) missing input validation patterns in REST API handlers that directly consume user-supplied parameters; (2) permission enforcement gaps in public-facing endpoints that should be access-controlled; (3) unsafe use of metadata update functions without allowlist validation; and (4) authentication bypass indicators where unauthenticated requests can modify sensitive user attributes. Extended reasoning across these skills would surface the attack chain—how an attacker exploits the missing permission check to reach the vulnerable function, then leverages unvalidated field copying to escalate privileges. Practitioners reviewing Casky findings would see flagged REST routes, identified metadata manipulation patterns, and the specific technique mapping to privilege escalation, enabling rapid remediation prioritization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14281.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14281

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14281. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn