Skip to content
Sign in
7.2 High

CVE-2025-0428 The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and…

Description

The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Affected products and versions

Product Affected versions Fixed in
AI Power: Complete AI Pack 1.8 earliest → 1.8.96 No fix stated
AI Puffer – Your AI engine for WordPress (formerly AI Power) 1.8 earliest → 1.8.96 No fix stated

Other CVEs of AI Power: Complete AI Pack

The 5 CVEs of AI Power: Complete AI Pack →
CVE-2025-0429 The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and… 7.2 High CVE-2024-13360 The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up… 5.4 Medium CVE-2024-13361 The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability… 6.3 Medium CVE-2024-10392 The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type… 9.8 Critical
Track this CVE