PT-2024-37280 · WordPress · The Aiomatic

István Márton · Published 2024-07-27 · Updated 2025-08-08 · CVE-2024-5969

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The AIomatic - Automatic AI Content Writer for WordPress versions up to, and including, 2.0.5

Description: The issue is due to insufficient limitations on the email recipient and the content in the aiomatic send email function, which are reachable via AJAX. This allows unauthenticated attackers to send emails with any content to any recipient.

Recommendations: For versions up to, and including, 2.0.5, consider disabling the aiomatic send email function until a patch is available to prevent exploitation. Restrict access to AJAX endpoints related to this function to minimize the risk of unauthorized email sending.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-5969

Affected Products

The Aiomatic

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-5969 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5969 · Vendor Advisory
• https://codecanyon.net/item/aiomatic-automatic-ai-content-writer/38877369?srsltid=AfmBOornCSKshlaSyZi2nonTcpSskMpBNJpdAS_No91A5V5lTIAD1h8S · Note
• https://t.me/cveNotify/131364 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/be5be40f-89da-4b97-9a85-527602d84c4d?source=cve · Note
• https://t.me/cvenotify/87638 · Telegram Post
• https://t.me/cvedetector/1749 · Telegram Post