Aimogen Pro: unauthenticated privilege escalation (CVE-2026-15982)
The Aimogen Pro plugin for WordPress has a vulnerability, CVE-2026-15982 (CVSS 9.8). The 'aiomatic_call_google_ai_function' function lacks a capability check.
Checked in Shield: no
Who is affected
WordPress sites running Aimogen Pro (Aiomatic) version 2.8.4 or earlier. Per the description, the attacker does not need to be authenticated and can use the 'aimogen_wp_god_mode' tool to run arbitrary PHP functions, e.g. create administrator accounts.
How to check
In the WordPress admin, open Plugins and check the Aimogen Pro version. Also review the list of administrator users for accounts you do not recognise.
How to fix
The source does not name a fixed version. Update the plugin as soon as a patched release is available; until then, consider deactivating it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and the fixed version are not disclosed yet. Source: NVD.
