PT-2025-46786 · WordPress · Ai Engine

Ismailshadow · Publicado 2025-11-13 · Atualizado 2025-11-18 · CVE-2025-12844

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.1.9

Description The AI Engine plugin for WordPress is susceptible to PHP Object Injection through PHAR Deserialization. This occurs due to the deserialization of untrusted input within the rest simpleTranscribeAudio and rest simpleVisionQuery functions. Authenticated attackers with Subscriber-level access or higher can inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Injection (POP) chain is installed, which could allow for actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

Recommendations Update AI Engine to version 3.1.9 or later.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2025-12844

Produtos afetados

Ai Engine

Referências · 11

• https://github.com/jordymeow/ai-engine/blob/main/classes/engines/chatml.php#L960-L967 · Nota
• https://github.com/jordymeow/ai-engine/blob/main/classes/modules/files.php#L237 · Nota
• https://github.com/jordymeow/ai-engine/blob/main/classes/services/image.php#L43 · Nota
• https://github.com/jordymeow/ai-engine/blob/main/classes/api.php#L799 · Nota
• https://t.me/cveNotify/142631 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/c39c1b72-e3e0-44fb-8fb8-602cb0aa61e3?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2025-12844 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1990736801246691603 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1988994966429819136 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-12844 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3392052 · Nota