PT-2025-47305 · WordPress · Ai Engine Plugin

Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-8084

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions through 3.1.8

Description The AI Engine plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 3.1.8. This issue is present in the rest helpers create images function. An authenticated attacker with Editor-level access or higher can leverage this to make web requests to arbitrary locations from the web application. This could allow querying and modification of information from internal services, and on Cloud instances, it enables metadata retrieval.

Recommendations Update the AI Engine plugin to a version later than 3.1.8.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8084

Affected Products

Ai Engine Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8084 · Security Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/rest.php#L742 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3b497bc0-bf47-43c7-9d5f-8e130dd0bab2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/services/image.php#L89 · Note
• https://twitter.com/CVEnew/status/1990786252119920985 · Twitter Post
• https://t.me/CVEtracker/37616 · Telegram Post