Aimogen Pro Vulnerability Allows Access

A severe security vulnerability has been identified within the Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress. This flaw, tracked as CVE-2026-15982, carries a critical severity rating and exposes affected installations to unauthorized privilege escalation.

Flaw in Capability Validation

The security gap stems from a missing capability check within the aiomatic_call_google_ai_function function. Because the plugin fails to verify user permissions during the execution of this specific function, it becomes possible for an unauthenticated user to interact with the system in ways that were intended to be restricted.

Unauthorized Administrator Account Creation

By leveraging the aimogen_wp_god_mode tool, an attacker can bypass existing security controls to perform unauthorized actions. Specifically, the vulnerability allows for the clearing of function blacklists, which in turn facilitates the execution of arbitrary PHP functions. This sequence of actions provides a path for an attacker to create new administrator accounts on the site.

• Advisory ID: GHSA-92gj-74pm-6cxp
• Vulnerability Type: Privilege Escalation
• Severity Score: 9.8 (CVSS)
• Affected Versions: Up to and including 2.8.4

Security Implications for Web Administrators

The presence of this vulnerability underscores the risks associated with third-party automation tools that include high-level system functions. Because the flaw allows for the creation of administrator accounts, the integrity and administrative control of any affected WordPress environment could be fully compromised. This suggests that administrators relying on this toolkit must exercise caution until the underlying function-handling issues are addressed.