Aiomatic WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Aiomatic WordPress plugin, specifically in versions through 2.5.0. This issue arises from inadequate file type validation in the 'aiomatic_image_editor_ajax_submit' function. As a result, authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution. Exploitation of this vulnerability requires the inclusion of a value for the Stability.AI API key, which can be arbitrary.

Impact

The vulnerability allows authenticated users with Subscriber-level access and above to upload arbitrary files to the server. This could be exploited to execute malicious code remotely, depending on the type of file uploaded.

Remediation

Users are advised to update the Aiomatic WordPress plugin to version 2.5.1 or a newer patched version.