The Aiomatic - Automatic AI Content Writer & Editor WordPress plugin suffers from an improper input validation vulnerability (CWE-20) in the 'aiomatic_send_email' function accessible via AJAX. This flaw allows unauthenticated remote attackers to send emails with arbitrary content to arbitrary recipients by exploiting insufficient restrictions on email parameters. The vulnerability affects versions up to and including 2.0.5. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity (email content manipulation) without confidentiality or availability impact.

An attacker can abuse this vulnerability to send arbitrary emails from the affected WordPress site without authentication. This can lead to the site being used as a spam relay or for phishing campaigns, potentially damaging the site's reputation and causing indirect harm to users who receive malicious emails. There is no direct impact on confidentiality or availability of the site itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to restrict access to the vulnerable AJAX endpoint if possible, or disable the Aiomatic plugin to prevent exploitation. Monitor official CodeRevolution communications for updates and apply any released patches promptly.