CVE-2024-13882
Published: 08 March 2025
Summary
CVE-2024-13882 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Coderevolution Aiomatic. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of file uploads to enforce type checking and prevent arbitrary file uploads exploiting the missing validation in aiomatic_generate_featured_image.
Ensures timely identification, reporting, and patching of the plugin flaw up to version 2.3.8 that enables arbitrary file uploads.
Enforces least privilege to restrict Contributor-level and higher access to the vulnerable image generation function, limiting who can perform uploads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability enables exploitation of public-facing WordPress application (T1190) and facilitates deployment of web shells for remote code execution (T1100).
NVD Description
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up…
more
to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Deeper analysisAI
CVE-2024-13882 affects the Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress, specifically in all versions up to and including 2.3.8. The vulnerability stems from missing file type validation in the 'aiomatic_generate_featured_image' function, enabling arbitrary file uploads. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with Contributor-level access or higher can exploit this issue over the network with low complexity and no user interaction required. By uploading arbitrary files to the WordPress site's server via the vulnerable function, attackers may achieve remote code execution, potentially compromising the entire server.
The plugin vendor's full changelog at coderevolution.ro and Wordfence threat intelligence advisory at wordfence.com detail remediation steps, including updates beyond version 2.3.8 to address the file validation flaw. Security practitioners should verify patch status and restrict Contributor access where possible.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability affects the Aiomatic WordPress plugin, which provides AI content writing, editing, GPT-3/GPT-4 integration, ChatGPT chatbot, and AI toolkit functionalities, fitting the Enterprise AI Assistants category as an AI assistant tool for content generation and automation.