CVE-2026-15982 Overview
CVE-2026-15982 is a privilege escalation vulnerability in the Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress. The flaw affects all versions up to and including 2.8.4. A missing capability check on the aiomatic_call_google_ai_function function allows unauthenticated attackers to invoke the aimogen_wp_god_mode tool. Attackers can clear function blacklists and execute arbitrary PHP functions, including creating administrator accounts. The issue is classified under [CWE-269: Improper Privilege Management].
Critical Impact
Unauthenticated attackers can execute arbitrary PHP functions and create WordPress administrator accounts, resulting in full site takeover.
Affected Products
- Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress
- All versions up to and including 2.8.4
- WordPress installations with the plugin activated
Discovery Timeline
- 2026-07-17 - CVE-2026-15982 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-15982
Vulnerability Analysis
The vulnerability resides in the aiomatic_call_google_ai_function function within the Aimogen Pro plugin. This function is exposed as a WordPress AJAX or REST endpoint but lacks a proper current_user_can() capability check. Any unauthenticated visitor can reach the handler and invoke privileged plugin functionality.
The plugin exposes an internal tool named aimogen_wp_god_mode intended for administrative automation tasks. Because the outer function does not verify caller identity or capabilities, this tool is reachable without authentication. The tool clears the plugin's function blacklist that would otherwise restrict which PHP functions can be executed.
Once the blacklist is cleared, attackers can invoke arbitrary PHP functions through the plugin's execution pathway. This includes calling wp_insert_user() or wp_create_user() to provision new WordPress accounts with the administrator role.
Root Cause
The root cause is a missing authorization check [CWE-269]. The handler aiomatic_call_google_ai_function does not enforce capability validation before executing privileged operations. Trust is placed on client-supplied parameters rather than on server-side identity verification.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a crafted HTTP request to the plugin's endpoint invoking the aimogen_wp_god_mode tool. The request clears function restrictions and then executes chosen PHP functions to create an administrator account or execute further code.
The vulnerability mechanism is described in the Wordfence advisory. No verified public exploit code is referenced in the NVD entry.
Detection Methods for CVE-2026-15982
Indicators of Compromise
- Unexpected WordPress administrator accounts appearing in wp_users with recent user_registered timestamps
- HTTP requests to plugin AJAX or REST endpoints containing references to aiomatic_call_google_ai_function or aimogen_wp_god_mode
- Modifications to plugin configuration options that store function blacklists or allowlists
- New or modified PHP files in wp-content/uploads/ or plugin directories following suspicious requests
Detection Strategies
- Audit WordPress user tables for administrator accounts created after plugin installation and correlate against known admin provisioning events
- Inspect web server access logs for POST requests targeting the Aimogen plugin action names, particularly from unauthenticated sessions
- Review WordPress activity logs for capability grants, role changes, and option updates tied to the Aimogen plugin
Monitoring Recommendations
- Enable web application firewall rules that block requests containing the aimogen_wp_god_mode parameter value from unauthenticated sources
- Alert on any creation of WordPress accounts holding the administrator role outside change-control windows
- Monitor filesystem integrity on the WordPress installation for newly added PHP files following requests to plugin endpoints
How to Mitigate CVE-2026-15982
Immediate Actions Required
- Deactivate and remove the Aimogen Pro plugin until a patched version above 2.8.4 is confirmed installed
- Audit the WordPress user table and revoke any unauthorized administrator or elevated accounts
- Rotate credentials for all administrator accounts and invalidate active WordPress sessions
- Review installed themes, plugins, and mu-plugins directories for webshells or backdoors dropped after exploitation
Patch Information
Refer to the vendor changelog at Code Revolution Changelog for the patched release. The Wordfence Vulnerability Report provides remediation guidance. Update to the fixed version tracked by the vendor and confirm the plugin no longer exposes aimogen_wp_god_mode to unauthenticated callers.
Workarounds
- Restrict access to wp-admin/admin-ajax.php and REST API endpoints associated with the plugin via web server ACLs until patched
- Deploy WAF signatures blocking requests referencing aiomatic_call_google_ai_function or aimogen_wp_god_mode from unauthenticated origins
- Disable the plugin entirely if a patch cannot be applied within the maintenance window
# Disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate aiomatic-automatic-ai-content-writer
wp plugin delete aiomatic-automatic-ai-content-writer
# Enumerate administrator accounts to identify unauthorized users
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
