PT-2025-46786 · WordPress · Ai Engine

Ismailshadow · Published 2025-11-13 · Updated 2025-11-18 · CVE-2025-12844

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.1.9

Description The AI Engine plugin for WordPress is susceptible to PHP Object Injection through PHAR Deserialization. This occurs due to the deserialization of untrusted input within the rest simpleTranscribeAudio and rest simpleVisionQuery functions. Authenticated attackers with Subscriber-level access or higher can inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Injection (POP) chain is installed, which could allow for actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

Recommendations Update AI Engine to version 3.1.9 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-12844

Affected Products

Ai Engine

References · 11

• https://osv.dev/vulnerability/CVE-2025-12844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12844 · Security Note
• https://github.com/jordymeow/ai-engine/blob/main/classes/engines/chatml.php#L960-L967 · Note
• https://github.com/jordymeow/ai-engine/blob/main/classes/modules/files.php#L237 · Note
• https://github.com/jordymeow/ai-engine/blob/main/classes/services/image.php#L43 · Note
• https://github.com/jordymeow/ai-engine/blob/main/classes/api.php#L799 · Note
• https://t.me/cveNotify/142631 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c39c1b72-e3e0-44fb-8fb8-602cb0aa61e3?source=cve · Note
• https://twitter.com/cracbot/status/1990736801246691603 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988994966429819136 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3392052 · Note