CVE-2024-13882
Published: 08 March 2025
Summary
CVE-2024-13882 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Coderevolution Aiomatic. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is affected by an arbitrary file upload vulnerability (CWE-434) in all versions through 2.3.8. The flaw stems from missing file type validation in the aiomatic_generate_featured_image function, which permits unauthenticated file handling once an authenticated session is present. The issue carries a CVSS 3.1 score of 8.8.
Authenticated users with Contributor-level access or higher can exploit the weakness by invoking the affected function to upload arbitrary files to the server. Successful exploitation may enable remote code execution on the host, granting the attacker control over site content and potentially the underlying web server.
The referenced changelog and Wordfence advisory indicate that the vendor has addressed the issue in subsequent releases; site operators should update to a patched version and restrict Contributor privileges where possible. The associated EPSS score remains flat at 0.0517 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54190
Vulnerability details
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up…
more
to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, chatgpt, gpt-3, gpt-4
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability enables exploitation of public-facing WordPress application (T1190) and facilitates deployment of web shells for remote code execution (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of file uploads to enforce type checking and prevent arbitrary file uploads exploiting the missing validation in aiomatic_generate_featured_image.
Ensures timely identification, reporting, and patching of the plugin flaw up to version 2.3.8 that enables arbitrary file uploads.
Enforces least privilege to restrict Contributor-level and higher access to the vulnerable image generation function, limiting who can perform uploads.