PT-2025-43590 · WordPress · Originality.Ai Ai Checker

Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-10902

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Originality.ai AI Checker plugin for WordPress versions through 1.0.12

Description The Originality.ai AI Checker plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the ai scan result remove function. Authenticated attackers possessing Subscriber-level access or higher can delete all data stored in the wp originalityai log database table. This table contains sensitive information, including post titles, scan scores, and credit usage data.

Recommendations Update the Originality.ai AI Checker plugin for WordPress to a version later than 1.0.12.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-10902

Affected Products

Originality.Ai Ai Checker

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10902 · Security Note
• https://t.me/CVEtracker/35648 · Telegram Post
• https://plugins.trac.wordpress.org/browser/originality-ai/trunk/OriginalityAI.php#L532 · Note
• https://twitter.com/CVEnew/status/1981643763953827933 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/80dd4f6a-20dd-4532-913b-ab08f89db836?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3371428 · Note