Skip to content
eastbaycyber

CVE-2026-15982: Unauthenticated Privilege Escalation in Aimogen Pro / Aiomatic

CVE explainers 11 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-17
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical CVSS 9.8 flaw in Aimogen Pro / Aiomatic for WordPress. - Affects versions through 2.8.4; upgrade to 2.8.5 or later. - No confirmed KEV listing or verified public PoC in this research, but urgency is high.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-15982
CVSS score 9.8 (Critical)
Attack vector Network
Auth required No
Patch available Yes, likely fixed in 2.8.5

CVE-2026-15982 is a critical unauthenticated privilege-escalation vulnerability in CodeRevolution’s Aimogen Pro / Aiomatic WordPress plugin. According to the NVD record, the issue affects all versions up to and including 2.8.4 and stems from a missing capability check in a plugin function exposed to remote requests.

For defenders, the practical implication is more severe than the phrase “privilege escalation” sometimes suggests. This is not a low-impact local bug. The described exploit path allows an unauthenticated attacker to abuse the plugin’s functionality to clear restrictions and invoke arbitrary PHP functions, including creating a new administrator account. In a WordPress environment, that should be treated as likely full site compromise.

What Is This Vulnerability?

The root cause, as documented by NVD, is a missing capability check in the function aiomatic_call_google_ai_function. In WordPress plugin development, capability checks are what ensure that only authorized users, such as administrators or editors with specific permissions, can invoke sensitive actions. If that guard is absent, a web-exposed function may become reachable by unauthenticated users or by users with insufficient privileges.

In this case, the vulnerable function can allegedly be abused together with the plugin’s aimogen_wp_god_mode tool. The impact chain described in the NVD record is especially important: an attacker can reach the function without authentication, use the “god mode” capability to clear function blacklists, and then execute arbitrary PHP functions. NVD specifically notes that one practical outcome is administrator account creation. Once an attacker creates an admin user in WordPress, they can usually install malicious plugins, edit themes, add persistence, alter content, or deploy a backdoor.

From a technical risk perspective, this is closer to remote compromise than to a narrowly scoped logic flaw. The CVSS vector reflects that severity: no authentication, no user interaction, low complexity, and high impact across confidentiality, integrity, and availability. Even if no public exploit is readily available, the vulnerability description itself is detailed enough that defenders should assume exploit development is feasible.

Technical Notes

A simplified example of the type of missing authorization pattern defenders should be thinking about in WordPress plugins looks like this:

function aiomatic_call_google_ai_function() {
    // Missing capability check such as:
    // if ( ! current_user_can('manage_options') ) { wp_die('Unauthorized'); }

    $tool = $_POST['tool'] ?? '';
    $function = $_POST['function'] ?? '';

    if ($tool === 'aimogen_wp_god_mode') {
        // Risky behavior if blacklist protections can be cleared
        // and arbitrary PHP functions become callable.
        call_user_func($function);
    }
}

That snippet is illustrative only, not vendor source. The important defensive takeaway is that any AJAX action, REST route, or direct web handler tied to aiomatic_call_google_ai_function should be treated as suspicious if it is reachable without a valid administrative session.

AnalystImpact · assess the risk

Who Is Affected?

The affected product is identified in the NVD record as Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress, also referred to in CodeRevolution materials as Aiomatic / Aimogen Pro. Based on the available sources, the vulnerable range is all versions up to and including 2.8.4.

The most likely fixed version is 2.8.5, based on alignment between the NVD range and a vendor changelog reference indicating that version 2.8.5 includes a security fix. There is an important caveat: automated retrieval of the vendor changelog returned HTTP 406 during the research process, so the exact changelog body could not be fully fetched directly. Still, the changelog URL is referenced by NVD, and search results indicate “Version 2.8.5 … Fixed security issue.” That makes 2.8.5 or later the most defensible remediation boundary.

If your organization uses the commercial CodeRevolution plugin rather than the public WordPress.org listing alone, you should verify the installed plugin slug, directory name, and version directly on disk or in the WordPress admin panel. Product naming in this family appears somewhat inconsistent across Aimogen, Aimogen Pro, and Aiomatic references, so asset inventory should confirm the exact installed package rather than relying only on plugin display names.

Technical Notes

You can verify the installed version in several ways on a WordPress host. Common checks include reading the plugin header or using WP-CLI:

wp plugin list | egrep 'aimogen|aiomatic'

grep -R "Version:" wp-content/plugins/ | egrep 'aimogen|aiomatic'

find wp-content/plugins -maxdepth 2 -type f -name "*.php" | egrep 'aimogen|aiomatic'

If the installed version is 2.8.4 or earlier, treat the site as vulnerable until proven otherwise.

CVSS Score Breakdown

The vulnerability has a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That is near-maximum severity and is consistent with what defenders would expect from a remotely reachable, unauthenticated pathway to arbitrary code-related actions or admin account creation.

Each component matters operationally. AV:N means the issue is exploitable over the network, which is why internet-facing WordPress instances are the highest priority. AC:L indicates low attack complexity, meaning exploitation should not require unusual preconditions. PR:N and UI:N are the real danger multipliers here: no privileges and no user interaction means there is no need to phish an admin or chain the bug with an authenticated foothold. An attacker can potentially move directly from discovery to compromise.

The Scope: Unchanged rating means the vulnerable component and impacted component are treated as within the same security boundary, but that does not reduce practical risk for site owners. The C:H/I:H/A:H triad reflects likely full impact: sensitive data exposure, site content tampering, account creation, plugin or theme installation, and potentially service disruption if arbitrary function execution is abused destructively.

For SMB defenders, the score should translate into a simple prioritization rule: if this plugin is present and the site is exposed to the internet, patch before routine maintenance work. This is not a “wait for next cycle” issue.

Exploitation Status

At the time of this research, CVE-2026-15982 was not listed in CISA’s Known Exploited Vulnerabilities catalog. That means there is no CISA-confirmed evidence of exploitation in the wild reflected in KEV at this time. Defenders should be careful not to overread that absence. KEV is a high-value signal, but non-inclusion does not mean exploitation is not happening.

A verified public PoC was not identified in the research material used here. NVD does not reference a public exploit repository, and no confirmed GitHub PoC was established from the available primary sources during this research run. A Wordfence advisory is referenced by NVD, but direct retrieval was blocked by an AWS WAF challenge, so additional exploitability detail could not be independently extracted from that page.

Operationally, the current state is: no confirmed KEV exploitation, no verified public PoC identified, but exploitation should be considered plausible and high risk. The reason is straightforward: the vulnerability description already provides enough of the attack logic to guide a competent adversary. Internet scans for vulnerable WordPress plugins are common, and admin-account creation is a highly desirable outcome for attackers.

Technical Notes

Treat suspicious activity as compromise until ruled out if you see any of the following shortly before a new admin account appears:

  • Requests to WordPress AJAX endpoints involving plugin-specific actions.
  • Requests referencing aiomatic_call_google_ai_function.
  • Requests or payloads referencing aimogen_wp_god_mode.
  • Unexpected new administrator users in wp_users and wp_usermeta.

Example triage query for web logs:

grep -REi 'aiomatic|aimogen|god_mode|admin-ajax\.php|google_ai_function' /var/log/nginx /var/log/apache2 2>/dev/null
ResponderRunbook · act now

How to Detect It

Detection should focus on two parallel tracks: request-level evidence of exploit attempts and post-exploitation evidence of WordPress admin creation or file tampering. Because the known impact includes arbitrary PHP function execution and admin account creation, successful exploitation may leave only subtle traces if the attacker quickly pivots to standard WordPress admin workflows.

Start with web server logs and WordPress audit trails. Look for requests to wp-admin/admin-ajax.php, REST endpoints, or plugin-specific handlers that mention aiomatic, aimogen, aiomatic_call_google_ai_function, or aimogen_wp_god_mode. Even if the exact parameter names vary, plugin-specific function references in requests are high-value indicators. Then review the timing of any new administrator account creation, password resets, plugin installations, theme edits, or option changes.

The second track is integrity review. Check for recently modified PHP files under wp-content/plugins/, wp-content/themes/, and wp-content/uploads/. Attackers who gain admin privileges often install a plugin, drop a one-file webshell, or use the built-in theme/plugin editor for persistence. Also audit the WordPress user table for unexpected accounts and confirm that all current administrators are legitimate.

Technical Notes

Concrete log-hunting examples:

# Search common web logs for plugin/function indicators
grep -RHiE 'aiomatic_call_google_ai_function|aimogen_wp_god_mode|aimogen|aiomatic' \
  /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null

# Look for recent admin user creation directly in WordPress database
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

-- Investigate recently created WordPress users
SELECT ID, user_login, user_email, user_registered
FROM wp_users
ORDER BY user_registered DESC
LIMIT 20;

Example suspicious request pattern to alert on in HTTP telemetry:

POST /wp-admin/admin-ajax.php
User-Agent: *
Body contains any of:
  action=...
  aiomatic_call_google_ai_function
  aimogen_wp_god_mode

If you use a SIEM, a simple detection query for normalized web logs might look like:

(event.dataset:web.access OR sourcetype=apache_access OR sourcetype=nginx_access)
AND (
  url.path="/wp-admin/admin-ajax.php"
  OR url.full:*aimogen*
  OR url.full:*aiomatic*
  OR http.request.body.content:*aiomatic_call_google_ai_function*
  OR http.request.body.content:*aimogen_wp_god_mode*
)

If you lack direct indicators because logs are incomplete, assume compromise is possible on exposed vulnerable instances and pivot to admin-account audit plus file integrity review.

Mitigation and Patching

The primary mitigation is to upgrade Aimogen Pro / Aiomatic to version 2.8.5 or later. Based on the available evidence, all versions through 2.8.4 are affected, and 2.8.5 is the likely first fixed release. If you cannot verify the exact installed version immediately, the safest assumption is that any internet-facing instance running this plugin may be at risk until updated.

Because the issue is unauthenticated and potentially allows admin creation, patching alone may not be sufficient if exposure has already occurred. After upgrading, review all administrator accounts, rotate WordPress admin credentials, inspect recently modified files, and check for unauthorized plugins or theme changes. If you find signs of abuse, treat the site as compromised and follow your incident response process, including credential rotation and restoration from known-good backups where needed.

If an immediate upgrade is not possible, use temporary containment. Restrict access to WordPress administrative endpoints where feasible, disable or remove the vulnerable plugin, and place the site behind a WAF with targeted rules for suspicious plugin-related requests. These are interim measures only; they do not replace upgrading to the fixed version.

Technical Notes

If the plugin is managed with WP-CLI and the fixed package is available through your deployment workflow, use your standard update mechanism. A generic WordPress plugin update command is:

wp plugin update aiomatic

If the commercial plugin is installed under a different slug or manually deployed package name, confirm the exact slug first:

wp plugin list | egrep 'aimogen|aiomatic'

Then update or replace the plugin with the vendor-provided 2.8.5 or later package. If manual replacement is required:

# Example workflow: disable plugin, back up, replace with fixed package
wp plugin deactivate aiomatic
tar -czf /root/aiomatic-backup-$(date +%F).tar.gz wp-content/plugins/aiomatic
# Upload/extract vendor-supplied 2.8.5+ package into wp-content/plugins/
wp plugin activate aiomatic
wp plugin list | egrep 'aimogen|aiomatic'

Temporary containment if patching must wait:

# Disable the plugin immediately
wp plugin deactivate aiomatic

Web-server level blocking can also reduce exposure to obvious probes, though it is not a substitute for patching:

location = /wp-admin/admin-ajax.php {
    if ($request_body ~* "(aiomatic_call_google_ai_function|aimogen_wp_god_mode|aiomatic|aimogen)") {
        return 403;
    }
}

That Nginx snippet is a stopgap only. It may not catch all exploit paths and should be tested carefully before production use.

References

The authoritative public source for the vulnerability details and CVSS vector is the NVD CVE record for CVE-2026-15982. It identifies the affected product, the vulnerable version range through 2.8.4, the missing capability check in aiomatic_call_google_ai_function, and the abuse of aimogen_wp_god_mode leading to arbitrary PHP function execution and administrator account creation.

For patch validation, the most relevant vendor-side source is the CodeRevolution changelog reference linked by NVD. During research, that page could not be fully retrieved due to HTTP 406, but search-result evidence indicated that version 2.8.5 includes a security fix. A Wordfence advisory is also referenced by NVD, but direct retrieval was blocked by WAF protections during the research process. In cases like this, defenders should rely on the NVD record for minimum-confirmed facts and validate the installed plugin version directly on their systems.

If any field remains uncertain in your environment, the safest assumption is that exposed sites running Aimogen Pro / Aiomatic 2.8.4 or earlier require urgent review, immediate upgrade to 2.8.5 or later, and compromise assessment focused on rogue administrator creation.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-17

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.