CVE-2024-13882 affects the Aiomatic - Automatic AI Content Writer & Editor WordPress plugin, specifically versions up to and including 2.3.8. The vulnerability arises from the lack of proper file type validation in the 'aiomatic_generate_featured_image' function, allowing authenticated users with Contributor-level privileges or higher to upload arbitrary files to the server. This can lead to remote code execution if malicious files are uploaded and executed. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Contributor-level access or higher can upload arbitrary files to the affected WordPress site, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability poses a significant risk to site security and data protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and monitor for suspicious file uploads. Avoid granting Contributor or higher privileges to untrusted users. Follow updates from the vendor for a security patch.