The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Fact-check summary

Wordfence reports a CVSS 9.8 unauthenticated privilege-escalation flaw in the Aimogen Pro WordPress plugin affecting versions up to 2.8.4, with details matching recent threat-intel entries.

2 caveats
  • ▲Specific CVE-2026-15982 not found in NVD or other sources; matching reports use CVE-2026-4038 or reference a recent Wordfence entry without that ID.
  • ▲CVE-2026-15982
Sourcing
1source

via NVD

NVD · track record
16Stories
100%Verified
1630d
All sources →
Home/Tech/Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro
VERIFIEDBy Xavier Rivera· ·1 min read

Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro

Aimogen Pro for WordPress through version 2.8.4 allows unauthenticated privilege escalation because the aiomatic_call_google_ai_function omits a capability check, letting attackers clear blacklists and run arbitrary PHP such as creating admin accounts. Wordfence rates it critical at CVSS 9.8; the CVE reached NVD on July 17, 2026.

Source:NVD
Post
Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro
TL;DRAI · 60 sec read

WordPress plugin Aimogen Pro contains a critical privilege escalation flaw in all versions up to 2.8.4. The vulnerability allows unauthenticated attackers to bypass capability checks, invoke god mode tools, remove function blacklists, and run arbitrary PHP code to create administrator accounts. It scores 9.8 on CVSS and lacks a listed fix.

The Aimogen Pro plugin for WordPress faces a newly published vulnerability that permits unauthenticated attackers to escalate privileges.

Aimogen Pro contains a privilege escalation vulnerability rated CVSS 9.8. According to the record, versions through 2.8.4 of the All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit lack a capability check inside the aiomatic_call_google_ai_function. This reportedly enables outsiders to invoke the aimogen_wp_god_mode tool, remove function blacklists, and run arbitrary PHP code that could create new administrator accounts.
Aimogen Pro contains a privilege escalation vulnerability rated CVSS 9.8.

The entry reached the CVE list and NVD dataset on July 17, 2026.

The flaw carries a critical severity rating from Wordfence. Wordfence supplied the CVSS 3.1 vector string "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" along with a base score of 9.8. NVD has not yet assigned a CVSS 4.0 rating.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The issue stems from improper privilege management. Wordfence classified the weakness as CWE-269. The affected product is listed under vendor CodeRevolution and runs from version 0 up to and including 2.8.4 using semantic versioning.
The flaw carries a critical severity rating from Wordfence.

References point to the vendor changelog and Wordfence threat intel. Two links appear in the record: the plugin's full changelog hosted at coderevolution.ro and Wordfence's dedicated vulnerability page. The published data does not list any patched version.
The NVD received the CVE from Wordfence at 2:16:36 AM on the same day it was published.
Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
vulnerabilitywordpresssecurity
More fromNVD
  • Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

    Tech · 4d
  • Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

    Tech · 4d
  • NVD Adds Shell Injection Flaw in Wazuh GitHub Actions Workflows as CVE-2026-67308

    Tech · 7d
More inTech
  • Tesla and SpaceX confirm Terafab chip fab in Texas

    Tech · 2d
  • OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

    Tech · 2d
  • Meta introduces Muse Code, its terminal-based coding agent

    Tech · 2d
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
SubscribeCircuitry Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Free forever.

MORE IN TECH

Tesla and SpaceX confirm Terafab chip fab in Texas

Tesla and SpaceX have confirmed Grimes County, Texas as the site for their Terafab semiconductor megafactory, with the first phase costing roughly $16.8 billion. The project targets the largest chip manufacturing facility on the planet to supply over 1 terawatt of compute per year that exceeds current and future global production capacity.

OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

OpenAI has filed a motion asking a federal judge to dismiss Apple's trade secrets lawsuit, describing the claims as meritless. The dispute, which follows a July suit and this week's injunction request from Apple, highlights tensions after their prior partnership on Siri and OpenAI's hardware push.

Meta introduces Muse Code, its terminal-based coding agent

Meta has released an early beta of Muse Code, a terminal-based coding agent driven by the updated Muse Spark 1.2 model and positioned against Anthropic's Claude Code and OpenAI's Codex. Substantially lower rates, including a contributor plan at $0.10 for every million tokens received, may encourage migration away from higher-priced options such as Anthropic's Sonnet 5.