Aimogen Pro EUVD-2026-45142

Exploitation requires that the Aimogen Pro / Aiomatic plugin (version ≤ 2.8.4) be installed and active on the target WordPress site, and that the 'aiomatic_call_google_ai_function' handler be reachable over HTTP - the CVSS PR:N/UI:N and description indicate no authentication, no user interaction, and no non-default configuration are needed beyond having the plugin active. The limiting factor is therefore product presence rather than access level: sites without this specific plugin are unaffected, and the 'aimogen_wp_god_mode' tool path is the concrete feature abused to clear the function blacklist and execute arbitrary PHP.

All signals point to high real-world priority rather than an inflated CVSS. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality/integrity/availability impact - consistent with the description of unauthenticated administrator creation. There is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data, so exploitation is currently unproven but technically trivial. The vector and description agree (no network-vs-local conflict), which increases confidence. The main uncertainty is deployment footprint: this is a paid third-party plugin, so exposure depends on how many sites run it, but any exposed instance is a straightforward full-takeover target once weaponized.

An attacker with no account sends a crafted HTTP request to the WordPress site invoking the unprotected 'aiomatic_call_google_ai_function' handler and triggers the 'aimogen_wp_god_mode' tool. Because no capability check runs, the tool clears the PHP function blacklist and calls a user-creation function, silently adding an attacker-controlled administrator that grants full control of the site. No public POC is referenced, but given AV:N/AC:L/PR:N the request is simple to construct once the endpoint is known.