sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-6206 Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload

High 7.5 Published Updated

Authenticated subscribers can upload arbitrary files leading to remote code execution if a Stability.AI API key is configured.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2025-6206?

CVE-2025-6206 is a high-severity vulnerability in CodeRevolution Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit, published on 24 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_image_editor_ajax_submit' function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. In order to exploit the vulnerability, there must be a value entered for the Stability.AI API key. The value can be arbitrary.

Weakness: CWE-434

Which versions are affected by CVE-2025-6206?

It affects 1 product.

Products include Coderevolution Aiomatic.

How do I fix CVE-2025-6206?

No fix has been published for CVE-2025-6206 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-6206 being exploited?

There is no known exploitation of CVE-2025-6206 in the wild and no public exploit code.

Sources

Also known as GHSA-w656-5j2g-vmwh.

Is CVE-2025-6206 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free