WooCommerce OTP plugin grants admin, no patch (CVE-2026-14281) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-14281 is a critical privilege escalation in the Advanced Country Code plugin for WordPress (part of Automation Web Platform - Notifications and OTP for WooCommerce) up to and including version 4.8.6 that lets unauthenticated attackers create a new administrator account and take full control of the site. No vendor patch is available yet; mitigation requires disabling the plugin or blocking the affected REST route.

Overview

CVE-2026-14281 affects every version of the Advanced Country Code plugin up to and including 4.8.6. The plugin exposes a public REST route, POST /wp-json/wawp/v1/signup/<op>, that accepts a wawp_custom_fields parameter. The finish_registration_logic function copies that caller-supplied data straight into update_user_meta() without checking permissions or restricting which meta keys are allowed.

WordPress stores a user’s role in the wp_capabilities and wp_user_level meta keys. Because those keys are not blocked, an attacker can set wp_capabilities to administrator during signup and receive a fully privileged account. No login, token, or existing access is required.

Impact

Successful exploitation gives an attacker complete administrative control: installing malicious plugins, modifying themes, exfiltrating the user database, and pivoting to any connected WooCommerce storefront. Because the account is created through the normal registration flow, it can blend into legitimate user activity. CVSS scores this 9.8 (network, low complexity, no privileges, no user interaction).

When OTP verification is enabled, the plugin weakens itself further. The OTP session token (otp_transient) is returned in plaintext in the HTTP response body, and handle_magic_link_request() marks any token verified on an unauthenticated GET request containing it, without ever checking the OTP code value. An attacker therefore never needs access to the victim’s inbox or SMS.

Remediation

No fixed version exists as of this writing. Until the vendor ships one:

• Disable the Advanced Country Code plugin if OTP or signup functionality is not essential.
• If it must stay active, block POST /wp-json/wawp/v1/signup/* and the magic-link GET route at the WAF or reverse proxy.
• Audit existing user accounts for unexpected administrators.
• Rotate credentials and review recent registrations for signs of tampering.

Continue monitoring vendor channels and our security news for a patched release. Site owners who suspect compromise should consult breach reports.

Security Insight

The flaw is a textbook case of trusting client input in a registration handler: sensitive meta keys like wp_capabilities should never be writable from an unauthenticated request, and OTP tokens belong in secure server-side sessions, not in response bodies. It echoes the pattern seen across dozens of WordPress plugins, where a single convenience feature ships without the permission checks WordPress provides by default. The plaintext OTP token alongside the copy-paste vulnerability suggests the plugin’s authentication layer was never threat-modeled, which is a warning sign for anyone running it in production.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs