CVE-2026-15982
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Aimogen Pro WordPress plugin contains a privilege escalation vulnerability. Missing capability checks in the 'aiomatic_call_google_ai_function' function allow unauthenticated attackers to use the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, including creating administrator accounts.
Risk Assessment
The risk is that an unauthenticated attacker can gain full control of the WordPress site, potentially leading to data theft, defacement, or using the site for further attacks.
Recommendation
Immediately update the Aimogen Pro plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Original NVD description (English source)
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.