Bao Le

**Name of the Vulnerable Software and Affected Versions** DevKit Pro plugin for WordPress versions prior to 2.3.1 **Description** An authorization flaw exists due to a missing capability check and missing nonce validation in the `DPDEV install themes func()` function registered on the `wp ajax DPDEV install themes` action. This allows authenticated attackers with Subscriber-level access or higher to install arbitrary theme ZIP packages containing PHP files. These files are extracted into the web-accessible `wp-content/themes/` directory, which may enable remote code execution. **Recommendations** Update the DevKit Pro plugin for WordPress to a version newer than 2.3.0. As a temporary mitigation, restrict access to the `DPDEV install themes func()` function.

**Name of the Vulnerable Software and Affected Versions** Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit versions prior to 2.8.5 **Description** This issue allows unauthenticated attackers to perform privilege escalation. The flaw exists because the `aiomatic call google ai function()` function lacks a proper capability check. An attacker can exploit this by using the `aimogen wp god mode` tool to clear function blacklists and execute arbitrary PHP functions, which can be used to create administrator accounts. **Recommendations** Update to a version newer than 2.8.4. As a temporary workaround, restrict access to the `aiomatic call google ai function()` function until the update is applied.