What is the CVSS score of CVE-2026-15982?

CVE-2026-15982 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Aimogen Pro are affected by CVE-2026-15982?

Aimogen Pro (Aiomatic) WordPress plugin contains a critical vulnerability (CVE-2026-15982) that allows unauthenticated attackers to create administrator accounts and achieve full site takeover.

How to fix or mitigate CVE-2026-15982?

Within 24 hours: Immediately disable the Aimogen Pro plugin in WordPress via the admin panel and confirm deactivation; consider complete removal if the plugin is not essential to critical business operations. Within 7 days: Audit all WordPress administrator accounts for unauthorized additions or modifications since plugin deployment, review web server access logs for suspicious AJAX activity targeting the aiomatic_call_google_ai_function handler, and reset credentials for all existing administrators. Within 30 days: Monitor Aiomatic's official security advisory channels and GitHub repository for patch release notifications; prepare a staged deployment procedure and test the patched version in a non-production environment before applying to production systems immediately upon vendor release.

Aimogen Pro CVE-2026-15982

EUVD-2026-45142 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-17 Wordfence

GHSA-92gj-74pm-6cxp

PHP WordPress Privilege Escalation Aimogen Pro All In One Ai Content Writer Editor Chatbot Automation Toolkit Coderevolution

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network AJAX handler with missing capability check yields arbitrary admin creation, so PR:N/UI:N/AC:L and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 06:06 vuln.today

CVE Published

Jul 17, 2026 - 05:35 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress Aimogen Pro Plugin - CVE-2026-15982 Jul 17, 2026

AnalysisAI

Privilege escalation in the Aimogen Pro (Aiomatic) all-in-one AI toolkit plugin for WordPress affects all versions through 2.8.4 and lets unauthenticated attackers create administrator accounts. The 'aiomatic_call_google_ai_function' AJAX handler lacks a capability check, allowing the 'aimogen_wp_god_mode' tool to clear function blacklists and invoke arbitrary PHP functions. No public exploit identified at time of analysis, but the pre-auth nature and 9.8 CVSS make this a full-site-takeover risk.

Technical ContextAI

The affected component is a commercial WordPress plugin from CodeRevolution (marketed as Aiomatic / Aimogen Pro) that wires WordPress into generative-AI services for content writing, chatbots, and automation. The root cause is CWE-269 (Improper Privilege Management): the 'aiomatic_call_google_ai_function' function is exposed (typically via WordPress's admin-ajax.php or REST layer) without a corresponding current_user_can() capability check or nonce verification, so any visitor can reach it. Once reachable, the plugin's 'aimogen_wp_god_mode' tool removes the internal function blacklist that would normally restrict dangerous calls, then executes arbitrary PHP functions such as wp_insert_user/wp_create_user to mint an administrator. The single CPE, cpe:2.3:a:coderevolution:aimogen_pro_-_all-in-one_ai_content_writer,_editor,_chatbot_&_automation_toolkit:*, covers all builds up to and including 2.8.4.

RemediationAI

Upgrade to a fixed release newer than 2.8.4 as published in the CodeRevolution changelog - no exact patched version number is stated in the provided data, so confirm the specific fixed build against the vendor changelog (https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/) and the Wordfence advisory before deploying. Until patched, block or restrict access to the admin-ajax.php action and REST endpoints tied to the 'aiomatic_call_google_ai_function'/'aimogen_wp_god_mode' handlers at a WAF (Wordfence firewall rules cover this class), or deactivate the plugin entirely if the AI features are non-essential - deactivation removes all functionality but eliminates the exposure. As a detective control, audit wp_users for unexpected administrator accounts created before patching, since a rogue admin persists even after the plugin is fixed.