PT-2025-31474 · WordPress · Ai Engine Wordpress Plugin

Ismailshadow · Published 2025-07-31 · Updated 2025-08-12 · CVE-2025-7847

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions 2.9.3 and 2.9.4

Description The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest simpleFileUpload() function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the affected site’s server when the REST API is enabled, potentially leading to remote code execution.

Recommendations Update to a version of the AI Engine plugin for WordPress that addresses this issue. Disable the REST API if it is not required. As a temporary workaround, restrict access to the rest simpleFileUpload() function.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-7847

Affected Products

Ai Engine Wordpress Plugin

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-7847 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332539%40ai-engine&new=3332539%40ai-engine&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1950789659795075357 · Twitter Post
• https://t.me/cveNotify/130349 · Telegram Post
• https://twitter.com/Sector_Sec/status/1955143227763462634 · Twitter Post
• https://t.me/CVEtracker/28823 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1c1c7ec9-d01f-433d-abec-dc2b6ff684c7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/api.php#L673 · Note
• https://twitter.com/Hossted_OSS/status/1954794310173380802 · Twitter Post
• https://twitter.com/CveFindCom/status/1950778719028588788 · Twitter Post
• https://twitter.com/cracbot/status/1952686059248058420 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/modules/files.php#L332 · Note
• https://plugins.trac.wordpress.org/changeset/3329842/ai-engine/trunk/classes/api.php · Note
• https://twitter.com/VulmonFeeds/status/1950886472489251314 · Twitter Post