CVE-2026-15982: WordPress Aimogen Pro Plugin Privilege Escalation (CVSS 9.8)

Executive Summary

CVE-2026-15982 is a critical privilege escalation vulnerability (CVSS 9.8) affecting the Aimogen Pro — All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress. All versions up to and including 2.8.4 are vulnerable.

The root cause is a missing capability check on the aiomatic_call_google_ai_function function, allowing any authenticated WordPress user — including those with only Subscriber-level access — to invoke privileged operations and escalate to Administrator.

Vulnerability Details

Root Cause

The vulnerability exists in the aiomatic_call_google_ai_function AJAX handler registered by the Aimogen Pro plugin. WordPress AJAX handlers must explicitly verify that the calling user has the appropriate capabilities (e.g., manage_options) before executing privileged actions. Aimogen Pro's handler omits this check entirely.

Because the AJAX endpoint is registered with the wp_ajax_ prefix (requiring only that the user be logged in), any authenticated user can trigger the handler. The handler's privileged execution path allows an attacker to elevate their user role to Administrator.

Attack Flow

1. Attacker registers or obtains any WordPress account (Subscriber role)
2. Sends crafted AJAX POST to wp-admin/admin-ajax.php
   action=aiomatic_call_google_ai_function
3. Handler executes without capability check
4. Attacker gains Administrator-level access
5. Full site takeover achieved — install themes, plugins, edit files

Why CVSS 9.8?

The near-maximum CVSS score reflects several amplifying factors:

• Low attack complexity — exploitation is trivially straightforward
• Low privileges required — any authenticated user (Subscriber) can exploit it
• No user interaction — the attack is fully automated
• High impact on Confidentiality, Integrity, and Availability — Administrator access means full control of the WordPress installation

Affected Scope

The Aimogen Pro plugin is marketed as an all-in-one AI content toolkit, used for automated content generation, chatbots, and marketing automation on WordPress sites. Sites using this plugin for AI-assisted content workflows are at risk.

Note: As of the NVD disclosure date (2026-07-17), verify the vendor's changelog for the exact patched version. Update immediately to any version above 2.8.4 or disable the plugin until patched.

Remediation

Immediate Actions

1. Update the plugin — Update Aimogen Pro to version 2.8.5 or later via the WordPress admin panel (Plugins → Updates)
2. If no patch is available — Deactivate and remove the Aimogen Pro plugin immediately
3. Audit user accounts — Review the WordPress user list for unexpected accounts with Administrator role
4. Review admin activity logs — Check for recent unexpected admin actions (plugin installs, theme changes, user role changes)

Post-Incident

If you suspect exploitation has already occurred:

1. Remove any unknown Administrator accounts
2. Reset passwords for all Administrator accounts
3. Scan for malicious file changes using a plugin like Wordfence or WP Cerber
4. Review recently modified files in wp-content/ for injected PHP
5. Consider restoring from a known-good backup taken before the suspected compromise window

WordPress Plugin Security Context

Missing capability checks are one of the most common vulnerability classes in WordPress plugins, consistently appearing in WPScan advisories. Plugin developers often register AJAX handlers without following WordPress's authorization best practices:

// VULNERABLE — no capability check
add_action('wp_ajax_aiomatic_call_google_ai_function', 'aiomatic_call_google_ai_function');
function aiomatic_call_google_ai_function() {
    // Privileged operations here — no current_user_can() check
}
 
// SECURE — with capability check
add_action('wp_ajax_aiomatic_call_google_ai_function', 'aiomatic_call_google_ai_function');
function aiomatic_call_google_ai_function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Privileged operations here
}

Detection

Signs of Exploitation

• Unexpected Administrator-level user accounts in WordPress
• Unknown plugins installed or activated
• Modified PHP files in wp-content/themes/ or wp-content/plugins/
• Admin activity logs showing role changes from Subscriber-level accounts
• Unusual outbound HTTP requests from the web server process

Server-Side Log Patterns

Look for POST requests to wp-admin/admin-ajax.php with action=aiomatic_call_google_ai_function from user sessions that should not be making admin calls.

Key Takeaways

1. CVSS 9.8 — Critical severity; any authenticated user can escalate to Admin
2. Exploit is trivial — A single AJAX POST with a subscriber-level session is all it takes
3. Update immediately — Patch to a version above 2.8.4 or remove the plugin
4. Audit your user roles — Check for unexpected Admins if you've been running a vulnerable version

References

• NVD — CVE-2026-15982
• WordPress Plugin Directory — Aimogen Pro
• WPScan Vulnerability Database
• WordPress Codex — Roles and Capabilities