THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro

VERIFIEDBy Xavier Rivera· ·1 min read

Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro

Aimogen Pro for WordPress through version 2.8.4 allows unauthenticated privilege escalation because the aiomatic_call_google_ai_function omits a capability check, letting attackers clear blacklists and run arbitrary PHP such as creating admin accounts. Wordfence rates it critical at CVSS 9.8; the CVE reached NVD on July 17, 2026.

Source:NVD

Post

Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro

TL;DRAI · 60 sec read

The Aimogen Pro plugin for WordPress faces a newly published vulnerability that permits unauthenticated attackers to escalate privileges.

Aimogen Pro contains a privilege escalation vulnerability rated CVSS 9.8. According to the record, versions through 2.8.4 of the All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit lack a capability check inside the aiomatic_call_google_ai_function. This reportedly enables outsiders to invoke the aimogen_wp_god_mode tool, remove function blacklists, and run arbitrary PHP code that could create new administrator accounts.

Aimogen Pro contains a privilege escalation vulnerability rated CVSS 9.8.

The entry reached the CVE list and NVD dataset on July 17, 2026.

The flaw carries a critical severity rating from Wordfence. Wordfence supplied the CVSS 3.1 vector string "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" along with a base score of 9.8. NVD has not yet assigned a CVSS 4.0 rating.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The issue stems from improper privilege management. Wordfence classified the weakness as CWE-269. The affected product is listed under vendor CodeRevolution and runs from version 0 up to and including 2.8.4 using semantic versioning.

The flaw carries a critical severity rating from Wordfence.

References point to the vendor changelog and Wordfence threat intel. Two links appear in the record: the plugin's full changelog hosted at coderevolution.ro and Wordfence's dedicated vulnerability page. The published data does not list any patched version.

The NVD received the CVE from Wordfence at 2:16:36 AM on the same day it was published.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

vulnerability wordpress security

MORE IN TECH

NVIDIA Locks in Initial 4.25 IT-GW at Ohio AI Campus Backed by SB Energy

NVIDIA has partnered with SB Energy to secure an initial 4.25 IT-GW of AI capacity at the PORTS-Pike campus in Ohio, with OpenAI as the customer for the full 8 IT-GW site under a 20-year lease. The agreement features a $1.5B NVIDIA investment in SB Energy, credit support for the buildout, creation of tens of thousands of jobs and an $80M community benefits fund.

iOS 27 Beta 5 Released as iPhone 18 Pro Details Surface

The fifth beta of iOS 27 arrived this week alongside an alleged iPhone 18 Pro Max battery leak showing 5,391 mAh capacity, screen protector images confirming asymmetric corners on the foldable iPhone Ultra, and Mark Gurman's report on radical Apple Watch redesigns that may include round faces and screenless trackers.

ShinyHunters Extortion Gang Leaks Data from 1.6 Million RingCentral Accounts

ShinyHunters obtained and later leaked personal data belonging to 1.6 million RingCentral accounts after a July breach. The incident touched only a limited portion of the cloud communications provider’s customers and left core services untouched.