Cyber Posture

CVE-2024-13882

High

Published: 08 March 2025

Published
08 March 2025
Modified
13 March 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0517 90.0th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13882 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Coderevolution Aiomatic. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Web Shell (T1505.003) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation of file uploads to enforce type checking and prevent arbitrary file uploads exploiting the missing validation in aiomatic_generate_featured_image.

prevent

Ensures timely identification, reporting, and patching of the plugin flaw up to version 2.3.8 that enables arbitrary file uploads.

prevent

Enforces least privilege to restrict Contributor-level and higher access to the vulnerable image generation function, limiting who can perform uploads.

MITRE ATT&CK Enterprise TechniquesAI

T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Arbitrary file upload vulnerability enables exploitation of public-facing WordPress application (T1190) and facilitates deployment of web shells for remote code execution (T1100).

NVD Description

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up…

more

to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Deeper analysisAI

CVE-2024-13882 affects the Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress, specifically in all versions up to and including 2.3.8. The vulnerability stems from missing file type validation in the 'aiomatic_generate_featured_image' function, enabling arbitrary file uploads. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Authenticated attackers with Contributor-level access or higher can exploit this issue over the network with low complexity and no user interaction required. By uploading arbitrary files to the WordPress site's server via the vulnerable function, attackers may achieve remote code execution, potentially compromising the entire server.

The plugin vendor's full changelog at coderevolution.ro and Wordfence threat intelligence advisory at wordfence.com detail remediation steps, including updates beyond version 2.3.8 to address the file validation flaw. Security practitioners should verify patch status and restrict Contributor access where possible.

Details

CWE(s)

Affected Products

coderevolution
aiomatic
≤ 2.3.9

AI Security AnalysisAI

AI Category
Enterprise AI Assistants
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
The vulnerability affects the Aiomatic WordPress plugin, which provides AI content writing, editing, GPT-3/GPT-4 integration, ChatGPT chatbot, and AI toolkit functionalities, fitting the Enterprise AI Assistants category as an AI assistant tool for content generation and automation.

CVEs Like This One

CVE-2025-7847Shared CWE-434
CVE-2025-26319Shared CWE-434
CVE-2020-36942Shared CWE-434
CVE-2024-57169Shared CWE-434
CVE-2023-53933Shared CWE-434
CVE-2025-68909Shared CWE-434
CVE-2021-47757Shared CWE-434
CVE-2025-68986Shared CWE-434
CVE-2025-56704Shared CWE-434
CVE-2025-0471Shared CWE-434

References