CVE-2024-13882: Aiomatic WordPress Plugin RCE Vulnerability

CVE-2024-13882 Overview

The Aiomatic WordPress plugin contains an arbitrary file upload vulnerability in the aiomatic_generate_featured_image function. All versions up to and including 2.3.8 fail to validate file types during upload operations. Authenticated attackers holding Contributor-level access or higher can upload malicious files to the server. Successful exploitation can lead to remote code execution on the affected WordPress site. The flaw is tracked as an Unrestricted Upload of File with Dangerous Type [CWE-434]. The affected product is coderevolution:aiomatic, distributed as a commercial AI content generation plugin for WordPress.

Critical Impact
Authenticated attackers with Contributor privileges can upload arbitrary files and achieve remote code execution on affected WordPress installations.

Affected Products

Aiomatic - Automatic AI Content Writer & Editor plugin for WordPress
All versions up to and including 2.3.8
Vendor: Coderevolution

Discovery Timeline

2025-03-08 - CVE-2024-13882 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13882

Vulnerability Analysis

The Aiomatic plugin exposes the aiomatic_generate_featured_image function to authenticated users. This function accepts file uploads intended for use as featured images on generated posts. The implementation omits file type validation, allowing any file extension or MIME type to be written to the server. An attacker can substitute a PHP script for the expected image content. Once the file lands in a web-accessible directory, the attacker can request it directly to execute arbitrary code within the WordPress process context.

WordPress Contributor accounts are commonly issued to guest authors and freelancers on multi-user blogs. This lowers the practical exploitation barrier because Contributor-level accounts are not intended to reach server-side code execution. The flaw combines missing input validation with insecure file handling, converting a content workflow feature into a code execution primitive.

Root Cause

The root cause is missing file type validation inside aiomatic_generate_featured_image. The function does not restrict uploads to known-safe image MIME types or extensions. It also does not verify magic bytes or sanitize the filename before writing to disk. This matches the [CWE-434] classification for unrestricted upload of files with dangerous types.

Attack Vector

The attack requires network access to the WordPress admin surface and authentication as a Contributor or higher role. The attacker calls the vulnerable function with a crafted upload request that references a PHP payload rather than an image file. After the file is stored on the server, the attacker retrieves it through a direct HTTP request to trigger execution. See the Wordfence Vulnerability Report for additional technical context.

// No verified proof-of-concept code is publicly available for this CVE.
// The vulnerability is triggered by an authenticated request to the
// aiomatic_generate_featured_image handler with a non-image file payload.

Detection Methods for CVE-2024-13882

Indicators of Compromise

Unexpected .php, .phtml, or .phar files written under wp-content/uploads/ or plugin-specific upload directories
Web server access log entries showing direct GET or POST requests to newly created files in upload paths
Contributor or Author accounts invoking the aiomatic_generate_featured_image action shortly before file creation events
Outbound network connections from the PHP-FPM or web server process to unfamiliar IP addresses following an upload event

Detection Strategies

Monitor file creation events in WordPress upload directories and alert on non-image extensions
Correlate WordPress audit logs with web server logs to identify Contributor sessions that trigger uploads followed by direct file requests
Inspect HTTP request bodies to the plugin endpoint for MIME type or filename mismatches

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and all plugin directories
Log all authenticated POST requests to admin-ajax.php and admin-post.php with the aiomatic_generate_featured_image action parameter
Track newly created Contributor or Author accounts and flag first-time upload activity

How to Mitigate CVE-2024-13882

Immediate Actions Required

Update the Aiomatic plugin to a version later than 2.3.8 as soon as a fixed release is available from the vendor
Audit all WordPress user accounts and remove unused Contributor, Author, and Editor accounts
Review upload directories for suspicious files created since the plugin was installed
Restrict PHP execution in wp-content/uploads/ using web server configuration

Patch Information

Refer to the vendor's Code Revolution Changelog for the current patched release. The Wordfence Vulnerability Report tracks the fixed version status.

Workarounds

Deactivate the Aiomatic plugin until a patched version is installed
Deny PHP execution inside upload directories through Apache or Nginx configuration
Apply a web application firewall rule that blocks non-image file uploads to the plugin endpoint
Reduce user roles so that only trusted administrators can access content generation features

bash

# Nginx: block PHP execution inside wp-content/uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}