Arbitrary File Upload Vulnerability in Aiomatic Plugin for WordPress

CVE-2025-6206

What is CVE-2025-6206?

The Aiomatic - Automatic AI Content Writer & Editor for WordPress is susceptible to an arbitrary file upload issue due to a failure in proper file type validation within the 'aiomatic_image_editor_ajax_submit' function. This vulnerability affects all versions up to and including 2.5.0. Authenticated attackers with a Subscriber-level access or higher can exploit this flaw to upload arbitrary files on the server, potentially leading to remote code execution. Successful exploitation requires that an arbitrary value be supplied for the Stability.AI API key, thereby enabling attackers to take control of the affected site's environment.

References