CVE-2026-14281Published
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-14281 · Microsoft / collected KEV context
cve-program · CVE-2026-14281
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=cve
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L1002
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L342
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/api/class-wawp-rest-settings-api.php#L574
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L477
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-otp-service.php#L787
- https://plugins.trac.wordpress.org/browser/automation-web-platform/tags/4.8.6/includes/auth-services/class-wawp-signup.php#L845
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L1002
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L342
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/api/class-wawp-rest-settings-api.php#L574
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L477
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-otp-service.php#L787
- https://plugins.trac.wordpress.org/browser/automation-web-platform/trunk/includes/auth-services/class-wawp-signup.php#L845
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3679350%40automation-web-platform&new=3679350%40automation-web-platform
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.