CVE-2026-15982 CodeRevolution CVE debrief

Who should care

Users of the Aimogen Pro plugin for WordPress should be aware of this vulnerability and take immediate action to protect their installations. This includes updating the plugin to a version beyond 2.8.4, implementing a Web Application Firewall (WAF) to detect and prevent exploitation attempts, and monitoring for suspicious activity, such as unusual administrator account creations.

Technical summary

The vulnerability exists due to a missing capability check on the 'aiomatic_call_google_ai_function' function in the Aimogen Pro plugin. This allows unauthenticated attackers to execute arbitrary PHP functions, potentially leading to the creation of administrator accounts. The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4.

Defensive priority

High

Recommended defensive actions

• Update the Aimogen Pro plugin to a version beyond 2.8.4
• Implement a Web Application Firewall (WAF) to detect and prevent exploitation attempts
• Monitor for suspicious activity, such as unusual administrator account creations
• Regularly review and update plugins and themes to ensure they are up-to-date and secure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-17T06:16:36.560Z and has not been modified since then. The NVD entry is currently in the 'Received' status. The Aimogen Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts. Defenders should verify the affected scope and severity, and review the supplied official advisory or CVE record to validate vendor guidance.

Official resources