PT-2025-30656 · WordPress · Ai Engine

Ismailshadow · Published 2025-07-24 · Updated 2025-07-24 · CVE-2025-7780

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions through 2.9.4

Description The AI Engine plugin for WordPress is susceptible to sensitive information exposure. The simpleTranscribeAudio API endpoint does not properly restrict URL schemes before invoking the get audio() function. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the web server and potentially exfiltrate them through the plugin’s OpenAI API integration.

Recommendations Update the AI Engine plugin to a version newer than 2.9.4. As a temporary workaround, restrict access to the simpleTranscribeAudio endpoint.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-7780

Affected Products

Ai Engine

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7780 · Security Note
• https://wordpress.org/plugins/ai-engine/#developers · Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/engines/chatml.php#L829 · Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/api.php#L625 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/513274bc-3016-4adb-be78-b13c5fae9c03?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1948511095271965142 · Twitter Post
• https://twitter.com/CVEnew/status/1948319172007452867 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3332540 · Note