CVE-2024-5969 AIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email Sending

What is CVE-2024-5969?

CVE-2024-5969 is a medium-severity vulnerability in CodeRevolution Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit, published on 27 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.

Weakness: CWE-20

Which versions are affected by CVE-2024-5969?

It affects 1 product.

Products include Coderevolution Aiomatic.

How do I fix CVE-2024-5969?

No fix has been published for CVE-2024-5969 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-5969 being exploited?

There is no known exploitation of CVE-2024-5969 in the wild and no public exploit code.

Other vulnerabilities in CodeRevolution Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit

• CVE-2024-13882 File upload in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit High 8.8
• CVE-2025-6206 Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload High 7.5
• CVE-2024-13816 Missing authorization in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit Medium 5.4
• CVE-2024-34435 WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerability Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3ww7-h83j-f3rc.