Critical WordPress AI Copilot Flaw Found

The AI Copilot – Content Generator plugin for WordPress contains a critical authorization bypass vulnerability, tracked as CVE-2026-14526. This flaw permits unauthenticated attackers to create new administrator-level user accounts, leading to a complete site takeover by executing malicious workflows.

What's at Risk

This vulnerability affects all versions of the AI Copilot – Content Generator plugin up to and including version 1.5.6. Any WordPress site using this plugin that has the [aiwu-form] shortcode or the public chatbot rendered on a frontend page is exposed. Because the necessary security token is exposed in public JavaScript, these internet-facing deployments are at high risk of unauthorized administrative account creation.

How the Flaw Works

This vulnerability stems from an authorization bypass, a common class of security weakness where an application fails to properly verify if a user possesses the required permissions to perform a sensitive action. In general, when an application relies on client-side tokens that are publicly accessible, it provides no real barrier against malicious requests. Attackers typically exploit these flaws by crafting requests that bypass the intended security checks, allowing them to invoke functions—such as user registration or administrative privilege escalation—that should be restricted to authenticated, high-level users.

How to Protect Your Systems

• Disable the AI Copilot plugin immediately if you cannot update.
• Check your WordPress user list for any unauthorized administrator accounts.
• Monitor server access logs for suspicious activity related to user creation endpoints.
• Follow the principle of least privilege by restricting administrative access to known, trusted IP addresses.
• Ensure all WordPress plugins are updated regularly to receive security patches.

With a CVSS score of 9.8, this vulnerability is categorized as critical. The ease with which an attacker can achieve a full site takeover makes immediate action necessary for any site administrator running the affected software. Promptly addressing this flaw is essential to maintaining the integrity and security of your WordPress environment.