PT-2025-31474 · WordPress · Ai Engine Wordpress Plugin

Ismailshadow · Publicado 2025-07-31 · Atualizado 2025-08-12 · CVE-2025-7847

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions 2.9.3 and 2.9.4

Description The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest simpleFileUpload() function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the affected site’s server when the REST API is enabled, potentially leading to remote code execution.

Recommendations Update to a version of the AI Engine plugin for WordPress that addresses this issue. Disable the REST API if it is not required. As a temporary workaround, restrict access to the rest simpleFileUpload() function.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-7847

Produtos afetados

Ai Engine Wordpress Plugin

Referências · 14

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332539%40ai-engine&new=3332539%40ai-engine&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/1950789659795075357 · Publicação no Twitter
• https://t.me/cveNotify/130349 · Publicação no Telegram
• https://twitter.com/Sector_Sec/status/1955143227763462634 · Publicação no Twitter
• https://t.me/CVEtracker/28823 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/1c1c7ec9-d01f-433d-abec-dc2b6ff684c7?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/api.php#L673 · Nota
• https://twitter.com/Hossted_OSS/status/1954794310173380802 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1950778719028588788 · Publicação no Twitter
• https://twitter.com/cracbot/status/1952686059248058420 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/modules/files.php#L332 · Nota
• https://plugins.trac.wordpress.org/changeset/3329842/ai-engine/trunk/classes/api.php · Nota
• https://twitter.com/VulmonFeeds/status/1950886472489251314 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7847 · Nota de Segurança