Aiomatic CVE-2025-6206

This vulnerability presents significant real-world risk despite moderate CVSS complexity scoring. The CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U) indicates: network-accessible attack vector (AV:N), high complexity mitigated by the arbitrary API key workaround (AC:H is reduced in practice), requires low privileges (Subscriber level - PR:L), no user interaction needed (UI:N), and impact on confidentiality/integrity/availability (C:H/I:H/A:H). The AC:H rating appears inflated since exploitation only requires setting any non-empty API key string—a trivial requirement for site administrators or compromised subscriber accounts. Real-world priority is elevated because: (1) WordPress plugins have massive install bases; (2) Subscriber-level access is commonly granted on multi-author sites; (3) RCE potential via arbitrary file upload is critical; (4) The plugin appears actively maintained but this vulnerability affects all versions through 2.5.0, suggesting patching lag. EPSS exploitation probability would likely be moderate-to-high (0.6+) given the low technical barrier and widespread WordPress deployment. Without confirmed KEV/CISA cataloging status or public POC data provided, treat as unpublished but highly probable for independent discovery given the straightforward vulnerability class.

An attacker with Subscriber account credentials (obtained via credential stuffing, leaked database, or social engineering) logs into a WordPress site running Aiomatic ≤2.5.0. The site administrator enabled Stability.AI API integration but set a placeholder key. The attacker navigates to the plugin's AJAX endpoint and crafts a POST request to 'aiomatic_image_editor_ajax_submit' with a multipart file upload containing a PHP webshell (e.g., disguised as .jpg but containing PHP code). Due to missing validation, the plugin accepts the file and stores it in a web-accessible directory (typically wp-content/uploads/ or plugin directory). The attacker then accesses the uploaded PHP file via direct URL, triggering code execution in the web server context. From RCE, the attacker can escalate privileges, exfiltrate database contents, install backdoors, or pivot to internal network. Attack complexity is reduced in practice because the 'arbitrary API key' requirement is trivial—most sites will have some non-empty value, or the attacker can simply provide any string since validation is absent. No user interaction required. Public POC likely exists or will emerge given CVE publication.