An unrestricted file upload vulnerability in the CodeRevolution Aimogen Pro WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server.

This is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434). It allows unauthenticated remote attackers to bypass security controls and upload malicious files, which can lead to Remote Code Execution (RCE).

This vulnerability carries a maximum CVSS score of 10.0, representing the highest level of risk. An attacker can achieve complete system compromise, leading to full data loss, unauthorized access, and the potential for the server to be used as a pivot point for further attacks within the network.

Immediate Action: Update the Aimogen Pro plugin to the latest version. If a patch is not available, remove the plugin from the production environment immediately to prevent RCE.

Proactive Monitoring: Inspect the web server's upload directories for suspicious file types (e.g., .php, .phtml, .sh) and monitor for unauthorized process execution on the web server.

Compensating Controls: Configure the web server to disable script execution in directories where user uploads are stored and employ a WAF to restrict file uploads to expected MIME types.

Public Exploit Available: Unknown

This is a critical, high-risk vulnerability that could lead to total server takeover. Immediate patching or removal of the vulnerable plugin is essential to maintain the security and integrity of the affected infrastructure.