EUVD-2026-13522Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request to aiomatic_call_ai_function_realtime endpoint
-
DeliveryBypass missing capability check
-
ExploitCall update_option function
-
ExecutionSet default registration role to administrator
-
PersistRegister new admin account
-
ImpactGain full site control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Aimogen Pro plugin for WordPress versions up to 2.7.5 must be installed and activated. The vulnerable 'aiomatic_call_ai_function_realtime' AJAX function lacks capability checks. Remote unauthenticated attackers can call arbitrary WordPress functions via AJAX to escalate privileges to administrator without user interaction. |
| Impact | This represents a critical real-world risk due to the combination of multiple high-severity factors: a 9.8 CVSS score with complete impact triad (C:H/I:H/A:H), network-accessible attack vector requiring no authentication or user interaction, and the ability to achieve full administrative compromise through privilege escalation. The vulnerability is automatable as attackers can programmatically call the vulnerable function to enable user registration with administrator privileges and subsequently register malicious admin accounts. While no EPSS score or KEV listing is currently available (possibly due to the recent 2026 CVE date or limited deployment of this premium plugin), the technical characteristics indicate high exploitability once discovered. The primary mitigating factor is that Aimogen Pro is a commercial CodeCanyon plugin rather than a widely-distributed free plugin, which may limit the attack surface compared to vulnerabilities in plugins with millions of installations. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Aimogen Pro version 2.7.5 or earlier through plugin enumeration. The attacker sends a crafted HTTP request to the vulnerable 'aiomatic_call_ai_function_realtime' function, invoking the WordPress 'update_option' function to change the site's default user registration role from 'subscriber' to 'administrator' and enable open registration. The attacker then immediately registers a new user account through the standard WordPress registration form, automatically receiving administrator privileges and gaining complete control over the website including the ability to install malicious plugins, modify content, steal data, or pivot to other systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
The Aimogen Pro plugin for WordPress contains an arbitrary function call vulnerability allowing unauthenticated attackers to execute privileged WordPress functions without authorization. All versions up to and including 2.7.5 are affected, enabling attackers to modify critical site settings such as changing the default user registration role to administrator, then registering as an admin to gain full site control. This is a critical authentication bypass with privilege escalation rated 9.8 CVSS, though no active exploitation (KEV) or public proof-of-concept has been reported at this time.
RemediationAI
Upgrade Aimogen Pro to version 2.7.6 or later when available from the vendor at CodeCanyon. Consult the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e45a17-cb41-41ba-ab6c-c83202f0ecfd?source=cve for detailed vulnerability information and patching guidance. Until a patched version can be installed, consider temporarily disabling the Aimogen Pro plugin if AI functionality is not immediately critical to site operations. Implement Web Application Firewall (WAF) rules to block requests targeting the 'aiomatic_call_ai_function_realtime' function endpoint. Additionally, audit WordPress user accounts for any suspicious administrator-level registrations that may indicate prior exploitation, review the 'default_role' option value in the WordPress options table to ensure it has not been modified to 'administrator', and temporarily disable user registration in WordPress settings (Settings → General → Membership) as a defense-in-depth measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects Aimogen Pro, a premium WordPress plugin sold on CodeCanyon that provides AI content generation, chatbot, and automation features. The root cause is CWE-862 (Missing Authorization), where the 'aiomatic_call_ai_function_realtime' function lacks capability checks to verify user permissions before processing requests. This design flaw allows arbitrary WordPress core functions to be invoked without authentication, including 'update_option' which modifies critical WordPress configuration options stored in the database. The CVSS vector indicates network-based exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), affecting confidentiality, integrity, and availability.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic_call_ai_function_realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update_option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Executive ViewAI
A critical vulnerability in the Aimogen Pro WordPress plugin (CVE-2026-4038, CVSS 9.8) allows unauthenticated attackers to bypass authentication and escalate privileges to administrator level, potentially giving threat actors complete control of affected websites. Organizations using this plugin face immediate risk of account takeover, data theft, and malicious site modification until remediation is completed.
Immediate mitigations in absence of patch: (1) Disable the Aimogen Pro plugin entirely if not critical to operations; (2) Implement Web Application Firewall (WAF) rules to block requests to vulnerable plugin functions; (3) Restrict plugin access via IP allowlisting or network segmentation; (4) Enable WordPress security logging and alert on new admin account creation; (5) Enforce strong password policies and multi-factor authentication on all admin accounts; (6) Monitor user registration settings for unauthorized changes; (7) Consider removing the plugin and identifying alternative solutions from vendors with active security support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
GitHub PoC
Exploit-DB