Advisories

The Aiomatic WordPress plugin, all versions up to and including 2.5.0, lacks file type validation in its aiomatic_image_editor_ajax_submit function, allowing arbitrary file uploads to the server. Authenticated users with Subscriber-level access or higher can exploit this, which may enable remote code execution. Exploitation requires a value entered for the Stability.AI API key, which can be arbitrary.