CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
Explanation of Vulnerability in Simple Terms
Aiomatic versions up to 2.0.5 contain an input validation flaw that allows an attacker to modify data on the site without authentication. The vulnerability requires no user interaction and can affect systems beyond the vulnerable component itself. Site administrators should update to a version newer than 2.0.5 to mitigate this risk.
What an attacker can do
Modify site data or content without logging in.
Potential impact on your site
Unauthorized changes to site content, settings, or data integrity without admin approval.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
