What is the CVSS score of CVE-2026-57719?

CVE-2026-57719 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Aimogen Pro are affected by CVE-2026-57719?

CodeRevolution's Aimogen Pro WordPress plugin (versions through 2.8.3) contains a critical unauthenticated remote code execution vulnerability via arbitrary file upload, affecting any WordPress…

How to fix or mitigate CVE-2026-57719?

Within 24 hours, identify all WordPress installations running Aimogen Pro and determine which are running version 2.8.3 or earlier; flag all affected systems as critical priority. Within 7 days, either completely disable and uninstall the Aimogen Pro plugin or restrict file upload functionality at the web server and firewall level by blocking HTTP POST requests to the plugin upload endpoints, and deploy Web Application Firewall rules to block file uploads with executable extensions (.php, .phtml, .php5, .jsp, etc.) in the plugin directory. Within 30 days, replace the affected plugin with a patched version from CodeRevolution if released, or transition to an alternative WordPress plugin solution; conduct a thorough security audit and file integrity check of all systems that ran the vulnerable version to detect and remove any backdoors or malicious code.

Aimogen Pro CVE-2026-57719

EUVD-2026-43372 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 Patchstack

WordPress File Upload Wordpress Plugin Aimogen Pro Coderevolution

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable upload with no validation yields code execution beyond the plugin (S:C) and full CIA loss; PR:N retained per supplied vector, though an authenticated variant is plausible and would raise PR.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:45 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.

AnalysisAI

Arbitrary file upload in CodeRevolution's Aimogen Pro WordPress plugin (versions up to and including 2.8.3) lets attackers upload files of dangerous types, typically enabling deployment of a PHP web shell and full remote code execution on the host. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates it 10.0 critical, reflecting network-reachable, low-complexity, unauthenticated exploitation with a scope change. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-434 Unrestricted Upload of File with Dangerous Type in a WordPress plugin (cpe:2.3:a:coderevolution:aimogen_pro). The root cause for this class is a file-upload handler that fails to validate the extension, MIME type, or content of submitted files, allowing an executable server-side script (e.g. a .php file) to be written into a web-accessible directory. On a PHP/WordPress stack, once such a file lands under the webroot it can be requested directly and executed by the PHP interpreter, converting an upload primitive into arbitrary code execution. Aimogen is marketed as an AI content/image generation plugin, which commonly exposes media or asset upload endpoints - a natural sink for this weakness.

RemediationAI

No vendor-released patch identified at time of analysis - Patchstack lists the fixed version as n/a, so a definitive upgrade target cannot be cited. As the primary compensating control, disable and remove the Aimogen Pro plugin until CodeRevolution publishes a patched release above 2.8.3, since deactivating it removes the vulnerable upload endpoint entirely (trade-off: loss of the plugin's AI generation features). Where the plugin must remain active, restrict access to its upload/admin endpoints via web-server rules or a WAF, and enforce a rule denying PHP execution within WordPress upload directories such as wp-content/uploads via an Apache/Nginx rule blocking script execution in that path (trade-off: may break plugins that legitimately serve dynamic content from uploads). Consider Patchstack virtual patching if subscribed, audit the uploads directory for recently added script files, and monitor the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/aimogen-pro/vulnerability/wordpress-aimogen-pro-plugin-2-8-3-arbitrary-file-upload-vulnerability?_s_id=cve for a fixed version.