WordPress Automation Web Platform Plugin Privilege Escalation and OTP Bypass

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 4.8.6.

• Affected versions: all versions up to and including 4.8.6.
• Missing permission enforcement on the publicly accessible REST route POST /wp-json/wawp/v1/signup/op.
• No key allowlist in finish_registration_logic, so attacker-controlled wawp_custom_fields is copied into update_user_meta().
• Impact: unauthenticated attackers can register an account with the administrator role and gain full administrative access.
• OTP bypass: when OTP verification is enabled, the OTP session token (otp_transient) is returned in plaintext in the HTTP response body, and handle_magic_link_request() marks it verified on any unauthenticated GET request containing it without checking the OTP code value.

This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. The OTP step is trivially bypassable with no inbox or SMS access required.