WordPress Aimogen Plugin Unauthenticated Privilege Escalation

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Aimogen Pro WordPress plugin contains a critical privilege escalation vulnerability (CVSS 9.8) affecting all versions through 2.8.4. An unauthenticated attacker can exploit a missing capability check on the 'aiomatic_call_google_ai_function' function to access the 'aimogen_wp_god_mode' tool, bypass function blacklists, and execute arbitrary PHP code. This allows attackers to create administrator accounts, install backdoors, or fully compromise WordPress installations. Any website running the vulnerable plugin is at immediate risk, regardless of user authentication status, making this a severe threat to the estimated thousands of WordPress deployments utilizing this content automation toolkit.

Casky's 224 mapped security skills detect this attack pattern by analyzing CWE-269 (Improper Access Control) indicators within MITRE ATT&CK's TA0004 (Privilege Escalation) framework. Practitioners using Casky would identify multiple detection signals: unauthorized capability bypass attempts targeting admin functions, suspicious PHP execution from unauthenticated contexts, function blacklist manipulation patterns, and admin account creation from unexpected sources. Claude's extended reasoning identifies the attack chain: missing input validation → capability check bypass → function blacklist evasion → arbitrary PHP execution. Security teams would see findings highlighting the absence of authentication middleware, unfiltered function parameters, and administrative action logging gaps—enabling rapid remediation through version updates and capability verification controls.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15982.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15982

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15982. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn