The plugin contains a missing file type validation in the aiomatic_image_editor_ajax_submit function, which permits authenticated users with Subscriber level or higher to upload arbitrary files to the site’s server. File content can be arbitrary; the presence of a Stability.AI API key value, which may be any string, is required for the exploit but does not limit the extent of the damage. Unsanitized uploads allow an attacker to place potentially executable files on the server, creating an avenue for remote code execution or other post‑exploitation activities.

The vulnerability affects the CodeRevolution Aiomatic WordPress plugin, all versions up to and including 2.5.0. Any site running an affected version of this plugin is potentially exposed.

The CVSS score of 7.5 marks the flaw as high severity. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires web access to the plugin’s AJAX endpoint and a logged‑in account with at least Subscriber privileges. An attacker sends a crafted upload request through aiomatic_image_editor_ajax_submit to place a file on the server, which, if executed, could lead to remote code execution.