Threat Entry Updated 2025-01-24

CVE-2025-0429 - Aipower Plugin

The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

PLUGIN Aipower

CVE-2025-0429

HIGH CVSS 7.2 2025-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-24

CVE-2025-0428 - Aipower Plugin

The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

PLUGIN Aipower

CVE-2025-0428

HIGH CVSS 7.2 2025-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-24

CVE-2024-13361 - Aipower Plugin

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.

PLUGIN Aipower

CVE-2024-13361

MEDIUM CVSS 6.3 2025-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-24

CVE-2024-13360 - Aipower Plugin

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Aipower

CVE-2024-13360

MEDIUM CVSS 5.4 2025-01-22

Risk Score

Open Full Technical Breakdown