CVE-2026-14281

Published 25 September 2026 · tracked since 25 September 2026

Description

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-100876 MEDIUM 6.3
• CVE-2026-100875 HIGH 7.3
• CVE-2026-100873 MEDIUM 4.3
• CVE-2026-100874 HIGH 7.3
• CVE-2026-101060 HIGH 8.2
• CVE-2026-101061 MEDIUM 4.7
• CVE-2026-101047 MEDIUM 5.3
• CVE-2026-101057 LOW 3.1
• CVE-2026-101058 MEDIUM 6.9
• CVE-2026-101044 HIGH 7.1

→ Open the live CVE board · all tools