AI Copilot WordPress Plugin Vulnerable to Authorization Bypass
The AI Copilot – Content Generator plugin for WordPress is reportedly vulnerable to authorization bypass, allowing unauthenticated attackers to create administrator-level accounts.
What happened
An early warning has been issued regarding a critical vulnerability, tracked as CVE-2026-14526, in the AI Copilot – Content Generator plugin for WordPress. This vulnerability, which affects all versions up to and including 1.5.6, appears to allow unauthenticated attackers to bypass authorization checks and create new administrator-level user accounts, leading to potential full site takeover. The severity of this issue is rated as CRITICAL with a CVSS score of 9.8.
Sites using the AI Copilot – Content Generator plugin are under investigation for potential exposure. It is recommended to closely monitor updates from the plugin developers and the National Vulnerability Database (NVD) for further information and patches. In the interim, reviewing site access controls and considering alternative solutions may help mitigate risk.
For the latest information and official advisories, consult the NVD entry for CVE-2026-14526 and any updates from the WordPress plugin repository. Stay tuned for further developments as this situation is actively being investigated.
How 0Day mitigates this
ai copilot – content generator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.