CVE-2026-15982 is a critical privilege escalation vulnerability in the Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit WordPress plugin. The vulnerability is due to improper privilege management (CWE-269) caused by a missing capability check on the 'aiomatic_call_google_ai_function' function. Exploitation allows unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating new administrator accounts. This affects all versions up to and including 2.8.4. No official patch or remediation guidance has been published yet.

Successful exploitation results in full system compromise through privilege escalation without authentication. Attackers can execute arbitrary PHP code, including creating administrator accounts, leading to complete control over the affected WordPress site. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling or removing it to prevent exploitation. Monitor for updates from CodeRevolution and apply patches promptly once available.