PT-2025-25473 · WordPress · The Ai Image Lab – Free Ai Image Generator

Kishan Vyas · Published 2025-06-14 · Updated 2025-06-14 · CVE-2025-4592

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The AI Image Lab – Free AI Image Generator plugin for WordPress versions 1.0.0 through 1.0.6

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This allows unauthenticated attackers to update the plugin's API key via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

Recommendations For versions 1.0.0 through 1.0.6, update the plugin to a version that includes the necessary nonce validation to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to the 'wpz-ai-images' page to prevent potential exploitation until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-4592

Affected Products

The Ai Image Lab – Free Ai Image Generator

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4592 · Security Note
• https://t.me/cvetracker/26239 · Telegram Post
• https://twitter.com/CVEnew/status/1933807796195123380 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3 · Note
• https://twitter.com/VulmonFeeds/status/1933846877591535680 · Twitter Post
• https://t.me/cvenotify/125707 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve · Note