CVE-2024-13816: Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete posts, list and delete batches, list assistant uploaded files, delete personas, delete forms, delete templates, and clear logs. The vulnerability was partially patched in version 2.3.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13816?
CVE-2024-13816 is identified as a critical vulnerability due to its potential for unauthorized access and data modification.
How do I fix CVE-2024-13816?
To fix CVE-2024-13816, update the Aiomatic plugin to the latest version that includes security patches addressing capability checks.
What software is affected by CVE-2024-13816?
CVE-2024-13816 affects the Aiomatic AI Content Writer, Editor, ChatBot & AI Toolkit plugin for WordPress up to and including version 2.3.6.
What kind of attacks can be executed due to CVE-2024-13816?
Due to CVE-2024-13816, attackers can exploit the vulnerability to gain unauthorized access, modify content, and potentially cause data loss.
Is there a specific version of Aiomatic that addresses CVE-2024-13816?
Yes, versions of Aiomatic after 2.3.6 contain fixes for the vulnerability highlighted in CVE-2024-13816.