What is the CVSS score of CVE-2026-4038?

CVE-2026-4038 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4038?

A critical vulnerability in the Aimogen Pro WordPress plugin (CVE-2026-4038, CVSS 9.8) allows unauthenticated attackers to bypass authentication and escalate privileges to administrator level,…

How to fix or mitigate CVE-2026-4038?

Within 24 hours: Audit all installations of Aimogen Pro plugin version 2.7.5 and below across your WordPress infrastructure; disable or deactivate the plugin immediately if no business-critical dependency exists. Within 7 days: Contact Aimogen Pro vendor for patch timeline and ETA; implement temporary network or WAF controls to restrict plugin access if disablement is not feasible; review admin user accounts for unauthorized creation. Within 30 days: Apply security patch immediately upon vendor release; conduct forensic analysis of access logs for signs of exploitation; enforce mandatory plugin update policies and version controls.

WordPress CVE-2026-4038

EUVD-2026-13522 CRITICAL

Missing Authorization (CWE-862)

2026-03-20 security@wordfence.com

WordPress Privilege Escalation Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13522

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 04:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic_call_ai_function_realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update_option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

AnalysisAI

The Aimogen Pro plugin for WordPress contains an arbitrary function call vulnerability allowing unauthenticated attackers to execute privileged WordPress functions without authorization. All versions up to and including 2.7.5 are affected, enabling attackers to modify critical site settings such as changing the default user registration role to administrator, then registering as an admin to gain full site control. This is a critical authentication bypass with privilege escalation rated 9.8 CVSS, though no active exploitation (KEV) or public proof-of-concept has been reported at this time.

Technical ContextAI

This vulnerability affects Aimogen Pro, a premium WordPress plugin sold on CodeCanyon that provides AI content generation, chatbot, and automation features. The root cause is CWE-862 (Missing Authorization), where the 'aiomatic_call_ai_function_realtime' function lacks capability checks to verify user permissions before processing requests. This design flaw allows arbitrary WordPress core functions to be invoked without authentication, including 'update_option' which modifies critical WordPress configuration options stored in the database. The CVSS vector indicates network-based exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), affecting confidentiality, integrity, and availability.

RemediationAI

Upgrade Aimogen Pro to version 2.7.6 or later when available from the vendor at CodeCanyon. Consult the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e45a17-cb41-41ba-ab6c-c83202f0ecfd?source=cve for detailed vulnerability information and patching guidance. Until a patched version can be installed, consider temporarily disabling the Aimogen Pro plugin if AI functionality is not immediately critical to site operations. Implement Web Application Firewall (WAF) rules to block requests targeting the 'aiomatic_call_ai_function_realtime' function endpoint. Additionally, audit WordPress user accounts for any suspicious administrator-level registrations that may indicate prior exploitation, review the 'default_role' option value in the WordPress options table to ensure it has not been modified to 'administrator', and temporarily disable user registration in WordPress settings (Settings → General → Membership) as a defense-in-depth measure.