Executive brief
The Automation Web Platform plugin for WordPress allows unauthenticated attackers to register new accounts with administrator privileges, bypassing all security checks. This gives attackers complete control over the WordPress site, including the ability to modify content, install malware, and access sensitive data. The vulnerability is particularly dangerous because the OTP verification step, if enabled, can be trivially bypassed without needing access to a phone number or email address.
Technical details
The vulnerability exists in the REST endpoint POST /wp-json/wawp/v1/signup/<op> which lacks permission checks and fails to validate the wawp_custom_fields parameter before passing it to update_user_meta(). This allows attackers to set sensitive meta keys like wp_capabilities and wp_user_level during registration. Additionally, when OTP is enabled, the otp_transient token is returned in plaintext and marked as verified on any unauthenticated GET request without validating the OTP code itself, allowing complete bypass of the multi-factor authentication step.
Affected products
- Automation Web Platform Notifications and OTP for WooCommerce, Advanced Country Code up to and including 4.8.6
Timeline
- 2026-09-25: disclosed