PT-2026-26553 · Coderevolution · Aimogen Pro - All-In-One Ai Content Writer

Hung Nguyen · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-4038

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic call ai function realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4038

Affected Products

Aimogen Pro - All-In-One Ai Content Writer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-4038 · Security Note
• https://codecanyon.net/item/aimogen-pro-allinone-ai-content-writer-editor-chatbot-automation-toolkit/38877369 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b3e45a17-cb41-41ba-ab6c-c83202f0ecfd?source=cve · Note