CVE-2025-6206: Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomaticimageeditorajaxsubmit' function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. In order to exploit the vulnerability, there must be a value entered for the Stability.AI API key. The value can be arbitrary.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6206?
CVE-2025-6206 has a high severity rating due to its potential for arbitrary file uploads.
How do I fix CVE-2025-6206?
To fix CVE-2025-6206, ensure you update the Aiomatic plugin to the latest version that includes file type validation.
Who is affected by CVE-2025-6206?
CVE-2025-6206 affects all versions of the Aiomatic AI Content Writer, Editor, ChatBot & AI Toolkit plugin up to version 2.5.0.
What kind of attack can exploit CVE-2025-6206?
CVE-2025-6206 can be exploited for arbitrary file upload attacks, allowing an attacker to upload malicious files to the server.
Is there a way to mitigate the risk of CVE-2025-6206?
Yes, you can mitigate the risk of CVE-2025-6206 by removing or disabling the Aiomatic plugin until it is patched.