CVE-2026-15982
A critical privilege‑escalation flaw exists in the Aimogen Pro WordPress plugin up to version 2.8.4. Unauthenticated attackers can exploit a missing capability check to run arbitrary PHP code, potentially creating administrator accounts. No official fix is currently available.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress, versions up to and including 2.8.4.
Real-world impact
Attackers can gain administrative control of the site, allowing them to create admin accounts, modify content, or execute any PHP function on the server.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑accessible, low‑complexity attack requiring no privileges or user interaction, with full impact on confidentiality, integrity, and availability.
What to do about it
- 01No official patch is available yet.
- 02Consider temporarily disabling the plugin or restricting access to its functionality until a fix is released.
- ›Disable the Aimogen Pro plugin if not essential.
- ›Apply web‑application firewall rules to block suspicious requests to the affected function.
- ›Monitor logs for unauthorized use of the 'aimogen_wp_god_mode' tool.
Remediation guidance is based on the absence of an official fix in the provided sources; follow vendor announcements for future patches.