CVE Explorer

CVE-2026-15982

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b9c00c23589b90ed4478e562ec8bf32a1fdbd8d80c30be3c20c50a7943a40e06

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit","vendor":"CodeRevolution","versions":[{"lessThanOrEqual":"2.8.4","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a9c7008691a436183121a361079356d2dd5ddaa6b6a0c396ef905b331f26226d · sha256:2d3881b2d65f429c… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:a9c7008691a436183121a361079356d2dd5ddaa6b6a0c396ef905b331f26226d · sha256:2d3881b2d65f429c… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:a9c7008691a436183121a361079356d2dd5ddaa6b6a0c396ef905b331f26226d · sha256:2d3881b2d65f429c… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a9c7008691a436183121a361079356d2dd5ddaa6b6a0c396ef905b331f26226d · sha256:2d3881b2d65f429c… · /containers/cna/references/1

{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53cc91fa-51fd-4d16-b740-a48f8d446b5d?source=cve"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a9c7008691a436183121a361079356d2dd5ddaa6b6a0c396ef905b331f26226d · sha256:2d3881b2d65f429c… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer