An unauthenticated user can exploit a missing capability check in the 'aiomatic_call_google_ai_function' function of the Aimogen Pro WordPress plugin. Because this function is callable without verifying user permissions, the attacker can trigger 'aimogen_wp_god_mode', clear function blacklists, and execute arbitrary PHP to create administrator accounts or perform other privileged operations, thereby compromising the entire WordPress site. Based on the description, the attacker sends a crafted HTTP request to the plugin’s endpoint to invoke the function without authentication; thus the likely attack vector is a direct, unauthenticated HTTP request targeting the plugin.

WordPress installations that have the Aimogen Pro plugin from CodeRevolution at versions 2.8.4 or earlier are affected to and including the specified patch level, which includes common deployment versions found in production sites and staging environments.

The CVSS score of 9.8 indicates critical severity, while the EPSS score below 1% suggests a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the lack of a capability check makes the flaw easy to exploit via a standard HTTP request to the plugin’s endpoint, which is inferred from the description that the function is callable without authentication. The attacker need not authenticate and can attain full administrative privileges, making this a high‑risk situation for any WordPress site hosting the vulnerable plugin.