Description

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-25T07:16:53.540Z",
  "pubdate": "2026-09-25T07:16:53.540Z",
  "executiveSummary": "The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is affected by a critical privilege escalation vulnerability in all versions up to and including 4.8.6.\nThe flaw stems from improper access control on the REST API endpoint 'POST /wp-json/wawp/v1/signup/<op>', allowing unauthenticated users to create accounts and manipulate user metadata.\nSuccessful exploitation permits an attacker to inject arbitrary user meta, including 'wp_capabilities' and 'wp_user_level', resulting in full administrative compromise of the WordPress installation.\nAdditionally, the plugin features a broken OTP verification mechanism where the 'otp_transient' token is leaked in plaintext, and the 'handle_magic_link_request()' function validates sessions without verifying the actual OTP code.\nThis combination of vulnerabilities allows an unauthenticated attacker to register an administrator account and bypass OTP security requirements entirely, posing a severe risk to site integrity and data confidentiality.\nNo authentication is required to initiate these attacks, and the exploitation is accessible via the network through standard HTTP requests.",
  "technicalDetails": "The vulnerability resides in the REST API route 'POST /wp-json/wawp/v1/signup/<op>'. The plugin fails to perform adequate permission checks, allowing unauthorized execution of the signup registration logic.\nThe core issue involves the 'finish_registration_logic' function, which processes the 'wawp_custom_fields' parameter. This parameter is directly passed to 'update_user_meta()' without an allowlist to sanitize or restrict input. Consequently, an attacker can supply malicious key-value pairs that overwrite sensitive WordPress user metadata, specifically 'wp_capabilities' and 'wp_user_level'. By setting 'wp_capabilities' to 'a:1:{s:13:\"administrator\";b:1;}', the attacker elevates the newly created user to administrative status.\nThe OTP verification process is inherently flawed. When OTP is enabled, the backend returns the 'otp_transient' session token in plaintext within the HTTP response body, exposing the internal state used for verification. The 'handle_magic_link_request()' handler subsequently validates this token upon any unauthenticated GET request. Critically, the handler fails to verify the actual OTP code provided by the user, effectively rendering the OTP mechanism a non-functional bypassable check.\nThe exploitation flow is as follows: 1) The attacker sends a 'POST' request to the vulnerable endpoint with custom metadata payloads designed to modify user capabilities. 2) If OTP is enabled, the attacker retrieves the 'otp_transient' from the response. 3) The attacker issues a GET request to the magic link handler, passing the transient token to finalize the bypass. 4) The server registers the user with the injected administrative capabilities. 5) The attacker authenticates as the new administrator to achieve full system control.\nThe vulnerable code persists across all versions up to and including 4.8.6. Because the API route is publicly accessible and lacks nonce validation or role-based access control, the attack surface is exposed to any network-capable actor."
}