Unauthorized Access Vulnerability in Aiomatic Plugin for WordPress by CodeRevolution
CVE-2024-13816
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 March 2025
What is CVE-2024-13816?
The Aiomatic plugin for WordPress has several security weaknesses due to insufficient capability checks, allowing authenticated attackers with Subscriber-level access or above to perform unauthorized actions. These actions include the ability to update and delete posts, manage batches, list uploaded files, and delete various elements such as personas and templates. This vulnerability poses a significant risk of data loss and unapproved modifications to content, impacting the integrity of the site. A partial fix was released in version 2.3.5.
Affected Version(s)
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit * <= 2.3.6