A security vulnerability tracked as CVE-2026-14526 affects the AI Copilot – Content Generator plugin for WordPress. All versions of the plugin up to and including 1.5.6 have this flaw, which occurs because the plugin does not properly verify that a user is authorized to perform sensitive actions.
This flaw makes it possible for unauthenticated attackers (people who do not have a login account for your site) to create a new full administrator account on your site, giving them complete control over all your website's content, settings and data. This exploit can only be used on sites where the plugin’s [aiwu-form] shortcode or public chatbot feature is displayed on a public-facing page.
The security check that is supposed to block unauthorized actions for these features is rendered into publicly accessible code on those pages, so it cannot stop unapproved requests from being processed.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-14526
