PT-2025-10416 · WordPress · The Aiomatic - Automatic Ai Content Writer & Editor

Lucio Sá · Published 2025-03-08 · Updated 2025-03-08 · CVE-2024-13816

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Aiomatic - Automatic AI Content Writer & Editor plugin for WordPress versions prior to 2.3.7

Description The issue allows authenticated attackers with Subscriber-level access and above to perform unauthorized actions, including updating and deleting posts, listing and deleting batches, listing assistant uploaded files, deleting personas, deleting forms, deleting templates, and clearing logs, due to missing capability checks on multiple functions.

Recommendations For versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting Subscriber-level access and above to minimize the risk of exploitation.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13816

Affected Products

The Aiomatic - Automatic Ai Content Writer & Editor

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13816 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13816 · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1898391986941362393 · Twitter Post
• https://t.me/cvedetector/19888 · Telegram Post
• https://t.me/cvenotify/113982 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/69de7d93-b255-4d41-8680-9762ff632804?source=cve · Note
• https://twitter.com/CVEnew/status/1898292474357121459 · Twitter Post
• https://t.me/cvetracker/18736 · Telegram Post
• https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/#item-description__changelog · Note