A critical privilege escalation vulnerability in the 101gen Automation Web Platform plugin allows unauthenticated attackers to register as administrators, granting them full control over affected sites.

The plugin fails to perform permission checks on the REST API endpoint used for user registration, and it lacks an allowlist for custom meta fields. This allows unauthenticated attackers to inject administrative roles during account creation, while also providing a trivial method to bypass OTP verification via predictable session tokens.

Successful exploitation grants an attacker full administrative privileges, leading to a total compromise of the WordPress environment. This level of access facilitates unauthorized data exfiltration, the injection of malicious code, and complete site takeover, posing a severe threat to business continuity and data integrity. The CVSS score of 9.8 reflects the ease of exploitation and the catastrophic nature of the impact.

Immediate Action: Since a specific patch version is currently unavailable, immediately deactivate and remove the Automation Web Platform plugin from your WordPress installation until an official update is released.

Proactive Monitoring: Review WordPress user account logs for suspicious newly created administrator accounts or unauthorized registrations occurring since the plugin was active.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests to the /wp-json/wawp/v1/ REST API path to prevent exploitation attempts while the plugin remains disabled.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the lack of a verified patch, administrators must prioritize the immediate removal or deactivation of the affected plugin. Total administrative takeover represents an existential risk to the platform, and any delay in mitigation increases the likelihood of unauthorized access by external actors.