What the vulnerability does
01Description
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Explanation of Vulnerability in Simple Terms
02Summary
The AI Copilot – Content Generator plugin versions 1.5.6 and earlier contain a privilege management flaw that allows unauthenticated attackers to gain full control over the application. No user interaction or special network conditions are required. An attacker can read sensitive data, modify content, and disrupt service availability.
What an attacker can do
03Attacker Capabilities
Read all data, modify or delete content, and disable the site without needing to log in.
Potential impact on your site
04Site Impact
Complete compromise of the plugin and potentially the entire site if it handles critical functions.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 8, 2026
CVE published
August 11, 2026
Record updated
