CVE-2026-14281 — WAWP (Automation Web Platform) Unauthenticated Privilege Escalation

Python 3 PoC for CVE-2026-14281 in the WordPress plugin Automation Web Platform (automation-web-platform — WAWP / Notifications & OTP for WooCommerce).

PoCbit

Listed on PoCbit — community catalog: https://pocbit.org/pocs/

Running the PoC prints a PoCbit header; JSONL lines include pocbit, pocbit_catalog, and pocbit_page.

Summary

The signup REST handler (public_permissions_check) accepts wawp_custom_fields, maps it to custom_fields_data, and after wp_insert_user() writes each key with update_user_meta() without an allowlist. Attackers can set wp_capabilities and wp_user_level to gain administrator.

Relevant code (4.8.6): includes/api/class-wawp-rest-settings-api.php (/signup/(?P<op>…)), includes/auth-services/class-wawp-otp-service.php (wawp_custom_fields → custom_fields_data), includes/auth-services/class-wawp-signup.php (finish_registration_logic).

When signup OTP is enabled, the first signup call may stop at otp_verify (challenge sent) and registration finishes only after OTP — full unauth admin chain may require OTP disabled or a separate OTP bypass. The PoC reports otp_required in that case.

Requirements

pip install -r requirements.txt

Python 3.8+.

Usage

# Version + REST surface + optional live signup probe (creates a throwaway user if OTP off)
python poc.py -u https://target.example --mode check

# Register admin-capable user (authorized targets only)
python poc.py -u https://target.example --mode exploit --verify

# Mass scan
python poc.py --list targets.example.txt --mode check --threads 20 --quiet

# JSON to stdout (single target)
python poc.py -u https://target.example --mode check 2>nul

Output

Status values (check)

FOFA hints

body="/wp-content/plugins/automation-web-platform/"
body="/wp-json/wawp/"

Legal

Use only on systems you own or have explicit permission to test.