What happened
A critical (CVSS 9.8) privilege escalation vulnerability was disclosed in a WordPress AI content-generation plugin, caused by a missing permission check on a function that invokes Google AI services.
Why it matters
WordPress AI plugins are widely installed on small-to-mid-size sites with limited security operations; missing capability checks on AI-integration endpoints let low-privileged or unauthenticated actors abuse the site's connected AI/Google API credentials or escalate privileges within the CMS.
Attack vector
The plugin's aiomatic_call_google_ai_function lacks a capability check, letting attackers with minimal privileges (e.g., Subscriber-level) call privileged AI-integration functions intended only for administrators.
Affected systems
Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit (WordPress plugin) up to and including 2.8.4
Mitigation
Update the Aimogen Pro / AIomatic plugin to a version that restores the missing capability check per the vendor changelog.